CVE-2024-9680
KEV
🔴 Łataj teraz
Wykorzystanie use-after-free w Firefox i Thunderbird umożliwia zdalne wykonanie kodu.
CVSS
9.8
EPSS
23.2%
Exploit
weaponized
Vendor
mozilla
Opis źródłowy (NVD)
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
brak
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 9.8 |
| CISA KEV (aktywnie wykorzystywane) | Tak |
| FIRST EPSS (prawdopodobieństwo exploita) | 23.2% |
| Opublikowano (NVD) | 2024-10-09 13:15:12 UTC |
| Ostatnia modyfikacja (NVD) | 2026-08-04 05:16:32 UTC |
Referencje
- https://bugzilla.mozilla.org/show_bug.cgi?id=1923344 (security@mozilla.org) [Issue Tracking, Permissions Required]
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039 (security@mozilla.org) [Not Applicable, Patch, Vendor Advisory]
- https://www.mozilla.org/security/advisories/mfsa2024-51/ (security@mozilla.org) [Vendor Advisory]
- https://www.mozilla.org/security/advisories/mfsa2024-52/ (security@mozilla.org) [Vendor Advisory]
- https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992 (af854a3a-2127-422b-91ae-364da2661108) [Issue Tracking]
- https://lists.debian.org/debian-lts-announce/2024/10/msg00005.html (af854a3a-2127-422b-91ae-364da2661108) [Mailing List]
- https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html (af854a3a-2127-422b-91ae-364da2661108) [Mailing List]
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680 (134c704f-9b21-4f2e-91b3-4a467353bcc0) [US Government Resource]