Lucene search

K
osvGoogleOSV:USN-6710-2
HistoryApr 04, 2024 - 1:36 a.m.

firefox regressions

2024-04-0401:36:16
Google
osv.dev
3
firefox
vulnerabilities
regressions
bounds checking
range analysis
out-of-bounds write
denial of service
arbitrary code
messagemanager listeners
event handler
software

8 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

16.2%

USN-6710-1 fixed vulnerabilities in Firefox. The update introduced
several minor regressions. This update fixes the problem.

Original advisory details:

Manfred Paul discovered that Firefox did not properly perform bounds
checking during range analysis, leading to an out-of-bounds write
vulnerability. A attacker could use this to cause a denial of service,
or execute arbitrary code. (CVE-2024-29943)

Manfred Paul discovered that Firefox incorrectly handled MessageManager
listeners under certain circumstances. An attacker who was able to inject
an event handler into a privileged object may have been able to execute
arbitrary code. (CVE-2024-29944)