Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2024-3857: Firefox and Thunderbird may crash during cleanup
CVE-2024-3857 · published 2 years ago
Summary
A flaw in the way Firefox (versions before 125) and Thunderbird (versions before 115.10) handle certain code can cause the programs to stop working when they clean up memory. This could lead to unexpected crashes for users. Updating to the latest version of each application will resolve the issue.
What to do
- Update debian firefox-esr to version 115.10.0esr-1~deb12u1.
- Update debian firefox-esr to version 115.10.0esr-1.
- Update debian thunderbird to version 1:115.10.1-1~deb12u1.
- Update debian thunderbird to version 1:115.10.1-1.
- Update mozilla thunderbird to version 115.10 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | firefox-esr |
< 115.10.0esr-1~deb12u1 Fix: upgrade to 115.10.0esr-1~deb12u1
|
| Debian:13 | debian | firefox-esr |
< 115.10.0esr-1 Fix: upgrade to 115.10.0esr-1
|
| Debian:14 | debian | firefox-esr |
< 115.10.0esr-1 Fix: upgrade to 115.10.0esr-1
|
| Debian:12 | debian | thunderbird |
< 1:115.10.1-1~deb12u1 Fix: upgrade to 1:115.10.1-1~deb12u1
|
| Debian:13 | debian | thunderbird |
< 1:115.10.1-1 Fix: upgrade to 1:115.10.1-1
|
| Debian:14 | debian | thunderbird |
< 1:115.10.1-1 Fix: upgrade to 1:115.10.1-1
|
| – | mozilla | firefox |
< 115.10 < 125.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* |
| – | mozilla | thunderbird |
< 115.10 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
10.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
Original advisory text
The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garbage collection. This vulnerability affects Firefox < 125, Firefox ESR < 115.10...
The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garbage collection. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
References
- https://security-tracker.debian.org/tracker/CVE-2024-3857 Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1886683 Issue Tracking
- https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html Mailing List Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html Mailing List Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2024-18/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2024-19/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2024-20/ Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-416Use After Free
Timeline
Published16 Apr 2024
Updated4 Nov 2026
First seen1 Sep 2026
Track software like this
Free during beta