Homepage
About Snyk

Reliance on Undefined, Unspecified or Implementation-Defined Behavior Affecting Firefox package, versions [,126)

Severity

 Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    EPSS
    0.04% (10th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-UNMANAGED-FIREFOX-6848789
  • published 15 May 2024
  • disclosed 14 May 2024
  • credit Ronald Crane
Report a new vulnerability Found a mistake?

Introduced: 14 May 2024

CVE-2024-4774 Open this link in a new tab
CWE-758 Open this link in a new tab

How to fix?

Upgrade Firefox to version 126 or higher.

Overview

Affected versions of this package are vulnerable to Reliance on Undefined, Unspecified or Implementation-Defined Behavior due to the ShmemCharMapHashEntry code. An attacker can trigger undefined behavior by bypassing the move semantics for one of its data members.

CVSS Scores

version 3.1
Expand this section

Snyk

4 medium
  • Attack Vector (AV)
    Local
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    None
  • Integrity (I)
    None
  • Availability (A)
    Low