Mozilla · Firefox
CVE-2024-9680
Mozilla Firefox Use-After-Free Vulnerability
Was es ist
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
CISA: Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.
Was zu tun ist
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Frist für US-Bundesbehörden: 5. November 2024
Weitere ausgenutzte Schwachstellen von Mozilla
| Hinzugefügt | Schwachstelle | Produkt | Schweregrad | Angriffswahrscheinlichkeit |
|---|---|---|---|---|
| 25.05.2022 | Security Feature Bypass | Firefox | Hoch 8,8 | 69% |
| 07.03.2022 | Use-After-Free | Firefox | Hoch 8,8 | 14% |
| 07.03.2022 | Use-After-Free | Firefox | Kritisch 9,6 | 2,4% |
| 03.03.2022 | Information Disclosure | Firefox | Mittel 6,5 | 6,7% |
| 06.10.2025 | Remote Code Execution | Multiple Products | Kritisch 9,8 | 83% |
| 22.06.2023 | Use-After-Free | Firefox, Firefox ESR, and Thunderbird | Hoch 7,5 | 87% |
| 23.05.2022 | Type Confusion | Firefox and Thunderbird | Hoch 8,8 | 38% |
| 23.05.2022 | Sandbox Escape | Firefox and Thunderbird | Kritisch 10,0 | 56% |
Quellen: Known Exploited Vulnerabilities (CISA, gemeinfrei), CVE records (cve.org) und EPSS (FIRST). Die Angriffswahrscheinlichkeit ist die EPSS-Schätzung, dass jemand in den nächsten 30 Tagen versucht, die Schwachstelle auszunutzen.