Homepage

Missing Authorization The advisory has been revoked - it doesn't affect any version of package firefox-x11  (opens in a new tab)

Threat Intelligence

EPSS
0.64% (46th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-FIREFOXX11-9474607
  • published18 Mar 2025
  • disclosed3 Sept 2024
Report a new vulnerability Found a mistake?

Introduced: 3 Sep 2024

CVE-2024-8383  (opens in a new tab)
CWE-862  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream firefox-x11 package and not the firefox-x11 package as distributed by RHEL.

Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems don't have a trusted newsreader installed by default, an unscrupulous program that the user downloaded could register itself as a handler. The website that served the application download could then launch that application at will. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Firefox ESR < 115.15.