Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2024-4777: Firefox and Thunderbird may let attackers run code
CVE-2024-4777 · published 2 years ago
Summary
Certain versions of Firefox (up to 125) and Thunderbird (up to 115.10) contain memory handling errors that could allow a skilled attacker to make the program do something it shouldn't, such as running their own code. Updating to Firefox 126 or later and Thunderbird 115.11 or later fixes the problem. Apply the latest updates as soon as possible.
What to do
- Update debian firefox-esr to version 115.11.0esr-1~deb12u1.
- Update debian firefox-esr to version 115.11.0esr-1.
- Update debian thunderbird to version 1:115.11.0-1~deb12u1.
- Update debian thunderbird to version 1:115.11.0-1.
- Update mozilla thunderbird to version 115.11.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | firefox-esr |
< 115.11.0esr-1~deb12u1 Fix: upgrade to 115.11.0esr-1~deb12u1
|
| Debian:13 | debian | firefox-esr |
< 115.11.0esr-1 Fix: upgrade to 115.11.0esr-1
|
| Debian:14 | debian | firefox-esr |
< 115.11.0esr-1 Fix: upgrade to 115.11.0esr-1
|
| Debian:12 | debian | thunderbird |
< 1:115.11.0-1~deb12u1 Fix: upgrade to 1:115.11.0-1~deb12u1
|
| Debian:13 | debian | thunderbird |
< 1:115.11.0-1 Fix: upgrade to 1:115.11.0-1
|
| Debian:14 | debian | thunderbird |
< 1:115.11.0-1 Fix: upgrade to 1:115.11.0-1
|
| – | mozilla | firefox |
< 115.11.0 < 126.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* |
| – | mozilla | thunderbird |
< 115.11.0 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
10.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
Original advisory text
Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these c...
Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
References
- https://security-tracker.debian.org/tracker/CVE-2024-4777 Vendor Advisory
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1878199%2C1893340 Issue Tracking
- https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html Mailing List
- https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html Mailing List
- https://www.mozilla.org/security/advisories/mfsa2024-21/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2024-22/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2024-23/ Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-787Out-of-bounds Write
CWE-416Use After Free
Timeline
Published14 May 2024
Updated4 Nov 2026
First seen1 Sep 2026
Track software like this
Free during beta