Stack-based buffer overflow in Mozilla Firefox - CVE-2024-0745

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU85711

Stack-based buffer overflow in Mozilla Firefox - CVE-2024-0745

Published: January 23, 2024


Vulnerability identifier: #VU85711
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-0745
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the WebAudio OscillatorNode object. A remote attacker can trick the victim to visit a specially crafted website, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

Mozilla Firefox
Gentoo Linux
openEuler
Ubuntu
Fedora
mozilla-crashreporter-firefox-debuginfo
firefox-debugsource
firefox-debuginfo
firefox
www-client/firefox
firefox (Ubuntu package)
firefox-flatpak

How to mitigate CVE-2024-0745

Install updates from vendor's website.

Mozilla Firefox - update to 122.0
mozilla-crashreporter-firefox-debuginfo - update to 79.0-31
firefox-debugsource - addressed in versions 79.0-31, 102.15.0-7
firefox-debuginfo - addressed in versions 79.0-31, 102.15.0-7
firefox - addressed in versions 79.0-31, 102.15.0-7
www-client/firefox - update to 104
firefox (Ubuntu package) - addressed in versions 122.0+build2-0ubuntu0.20.04.1, 122.0.1+build1-0ubuntu0.20.04.1
firefox-flatpak - update to 122.0-1
firefox - addressed in versions 122.0-1.fc38, 122.0-1.fc39

External References

Related Security Bulletins