CVE-2024-9394 Affecting firefox-esr package, versions <128.3.0esr-1


Severity

Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.09% (41st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-FIREFOXESR-8138603
  • published2 Oct 2024
  • disclosed1 Oct 2024

Introduced: 1 Oct 2024

CVE-2024-9394  (opens in a new tab)

How to fix?

Upgrade Debian:unstable firefox-esr to version 128.3.0esr-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream firefox-esr package and not the firefox-esr package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the resource://devtools origin. This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

CVSS Scores

version 3.1