CVE-2024-7519

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-7519
Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

9.6 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1902307 Issue Tracking Permissions Required
https://www.mozilla.org/security/advisories/mfsa2024-33/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-34/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-35/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-37/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-38/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:128.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:128.0.1:*:*:*:*:*:*:*
History

12 Aug 2024, 16:04

Type Values Removed Values Added
First Time Mozilla firefox
Mozilla firefox Esr
Mozilla thunderbird
Mozilla
CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:128.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:128.0.1:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 9.6
References () https://bugzilla.mozilla.org/show_bug.cgi?id=1902307 - () https://bugzilla.mozilla.org/show_bug.cgi?id=1902307 - Issue Tracking, Permissions Required
References () https://www.mozilla.org/security/advisories/mfsa2024-33/ - () https://www.mozilla.org/security/advisories/mfsa2024-33/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2024-34/ - () https://www.mozilla.org/security/advisories/mfsa2024-34/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2024-35/ - () https://www.mozilla.org/security/advisories/mfsa2024-35/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2024-37/ - () https://www.mozilla.org/security/advisories/mfsa2024-37/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2024-38/ - () https://www.mozilla.org/security/advisories/mfsa2024-38/ - Vendor Advisory

07 Aug 2024, 21:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CWE CWE-787
Summary
  • (es) Las comprobaciones insuficientes al procesar la memoria compartida de gráficos podrían haber provocado daños en la memoria. Un atacante podría aprovechar esto para realizar un escape de la zona de pruebas. Esta vulnerabilidad afecta a Firefox &lt; 129, Firefox ESR &lt; 115.14, Firefox ESR &lt; 128.1, Thunderbird &lt; 128.1 y Thunderbird &lt; 115.14.

06 Aug 2024, 23:15

Type Values Removed Values Added
References
  • () https://www.mozilla.org/security/advisories/mfsa2024-37/ -
  • () https://www.mozilla.org/security/advisories/mfsa2024-38/ -
Summary (en) Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1. (en) Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

06 Aug 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-06 13:15

Updated : 2024-08-12 16:04

NVD link : CVE-2024-7519

Mitre link : CVE-2024-7519

CVE.ORG link : CVE-2024-7519

JSON object : View

Products Affected

mozilla

  • thunderbird
  • firefox_esr
  • firefox
CWE
CWE-787

Out-of-bounds Write