Incomplete WebAssembly Exception Handling Leads to Use-After-Free Vulnerability in Firefox
CVE-2024-7521

8.8HIGH

Key Information:

Vendor

Mozilla
Status
Firefox
Firefox Esr
Vendor
CVE Published:
6 August 2024

What is CVE-2024-7521?

A vulnerability exists in Firefox and Thunderbird due to incomplete handling of exceptions in WebAssembly, which can result in a use-after-free scenario. This can potentially allow an attacker to execute arbitrary code or cause a denial of service through carefully constructed web content. The affected versions include Firefox versions prior to 129, multiple Firefox ESR versions below 115.14 and 128.1, and Thunderbird versions below 128.1 and 115.14. Users are advised to update their software to mitigate risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Firefox < 129

Firefox ESR < 115.14

Firefox ESR < 128.1

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1904644
https://www.mozilla.org/security/advisories/mfsa2024-33/
https://www.mozilla.org/security/advisories/mfsa2024-34/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nils Bars
JSON
.