Mozilla · Firefox
CVE-2024-9680
Mozilla Firefox Use-After-Free Vulnerability
O que é
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
CISA: Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.
O que fazer
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Prazo para as agências federais dos EUA: 5 de novembro de 2024
Mais falhas exploradas de Mozilla
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 25 de mai. de 2022 | Security Feature Bypass | Firefox | Alto 8,8 | 69% |
| 7 de mar. de 2022 | Use-After-Free | Firefox | Alto 8,8 | 14% |
| 7 de mar. de 2022 | Use-After-Free | Firefox | Crítica 9,6 | 2,4% |
| 3 de mar. de 2022 | Information Disclosure | Firefox | Média 6,5 | 6,7% |
| 6 de out. de 2025 | Remote Code Execution | Multiple Products | Crítica 9,8 | 83% |
| 22 de jun. de 2023 | Use-After-Free | Firefox, Firefox ESR, and Thunderbird | Alto 7,5 | 87% |
| 23 de mai. de 2022 | Type Confusion | Firefox and Thunderbird | Alto 8,8 | 38% |
| 23 de mai. de 2022 | Sandbox Escape | Firefox and Thunderbird | Crítica 10,0 | 56% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.