CVE-2024-9936
When manipulating the selection node cache, an attacker may have been able to cause unexpected...
6.5 MediumFix available
When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitable crash. This vulnerability affects Firefox < 131.0.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
0.27%Up 0.2 points since Oct 15, 2024
What each source reports
CVE List Score used
When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitable crash. This vulnerability affects Firefox < 131.0.3.
- Record
CVE-2024-9936- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
EUVDEUVD-2024-50224
When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitable crash. This vulnerability affects Firefox < 131.0.3.
- Record
EUVD-2024-50224- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8c7g-vx5g-cmpg
When manipulating the selection node cache, an attacker may have been able to cause unexpected...
When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitable crash. This vulnerability affects Firefox < 131.0.3.
- Record
GHSA-8c7g-vx5g-cmpg- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
NVD
When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitable crash. This vulnerability affects Firefox < 131.0.3.
- Record
CVE-2024-9936- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-9936
When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitable crash. This vulnerability affects Firefox < 131.0.3.
- Record
UBUNTU-CVE-2024-9936- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14415-1 No score
MozillaFirefox-131.0.3-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-131.0.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14415-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11373-1 No score
firefox-esr-153.0-1.1 on GA media
These are all security issues fixed in the firefox-esr-153.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11373-1- Updated
- 2026-11-02
OSVUSN-7078-1 No score
firefox vulnerability
Atte Kettunen discovered that Firefox did not properly validate before inserting ranges into the selection node cache. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
- Record
USN-7078-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mozjs52Ubuntu:18.04:LTS |
All versions, plus listed versions 52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1 |
None known |
mozjs38Ubuntu:18.04:LTS |
All versions, plus listed versions 38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4 |
None known |
firefoxUbuntu:20.04:LTS |
before 131.0.3+build1-0ubuntu0.20.04.1, plus listed versions 69.0.3+build1-0ubuntu170.0+build2-0ubuntu170.0+build2-0ubuntu270.0.1+build1-0ubuntu271.0+build2-0ubuntu2 Show 45 moreShow less71.0+build5-0ubuntu172.0.1+build1-0ubuntu172.0.2+build1-0ubuntu173.0+build1-0ubuntu173.0+build2-0ubuntu173.0+build3-0ubuntu173.0.1+build1-0ubuntu174.0+build1-0ubuntu174.0+build2-0ubuntu174.0+build2-0ubuntu274.0+build3-0ubuntu175.0+build3-0ubuntu176.0+build2-0ubuntu0.20.04.176.0.1+build1-0ubuntu0.20.04.177.0.1+build1-0ubuntu0.20.04.178.0.1+build1-0ubuntu0.20.04.178.0.2+build2-0ubuntu0.20.04.179.0+build1-0ubuntu0.20.04.180.0+build2-0ubuntu0.20.04.180.0.1+build1-0ubuntu0.20.04.181.0+build2-0ubuntu0.20.04.181.0.2+build1-0ubuntu0.20.04.182.0+build2-0ubuntu0.20.04.182.0.2+build1-0ubuntu0.20.04.182.0.3+build1-0ubuntu0.20.04.183.0+build2-0ubuntu0.20.04.184.0+build3-0ubuntu0.20.04.184.0.1+build1-0ubuntu0.20.04.184.0.2+build1-0ubuntu0.20.04.185.0+build1-0ubuntu0.20.04.185.0.1+build1-0ubuntu0.20.04.186.0+build3-0ubuntu0.20.04.186.0.1+build1-0ubuntu0.20.04.187.0+build3-0ubuntu0.20.04.288.0+build2-0ubuntu0.20.04.188.0.1+build1-0ubuntu0.20.04.289.0+build2-0ubuntu0.20.04.289.0.1+build1-0ubuntu0.20.04.189.0.2+build1-0ubuntu0.20.04.190.0+build1-0ubuntu0.20.04.190.0.2+build1-0ubuntu0.20.04.191.0+build2-0ubuntu0.20.04.191.0.1+build1-0ubuntu0.20.04.191.0.2+build1-0ubuntu0.20.04.192.0+build3-0ubuntu0.20.04.1 |
131.0.3+build1-0ubuntu0.20.04.1 |
mozjs68Ubuntu:20.04:LTS |
All versions, plus listed versions 68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1 |
None known |
mozjs52Ubuntu:20.04:LTS |
All versions, plus listed versions 52.9.1-1build152.9.1-1ubuntu3 |
None known |
mozjs102Ubuntu:22.04:LTS |
All versions, plus listed versions 102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1 |
None known |
mozjs78Ubuntu:22.04:LTS |
All versions, plus listed versions 78.13.0-178.15.0-278.15.0-4ubuntu1 |
None known |
mozjs91Ubuntu:22.04:LTS |
All versions, plus listed versions 91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1 |
None known |
mozjs102Ubuntu:24.04:LTS |
All versions, plus listed versions 102.15.1-1102.15.1-3ubuntu2 |
None known |
mozjs115Ubuntu:24.04:LTS |
All versions, plus listed versions 115.3.0-0ubuntu1115.4.0-2115.5.0-1115.6.0-1115.7.0-4 Show 4 moreShow less115.8.0-1115.9.0-1115.9.0-1build1115.10.0-1 |
None known |
MozillaFirefoxopenSUSE:Tumbleweed |
before 131.0.3-1.1 | 131.0.3-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 228 CVEs |
before 153.0-1.1 | 153.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-9936 is a medium vulnerability (CVSS 6.5) in Mozilla Firefox, published October 14, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 20th percentile. Fixed in firefox 131.0.3+build1-0ubuntu0.20.04.1.
References
bugzilla.mozilla.org/show_bug.cgi?id=1920381
mozilla.org/security/advisories/mfsa2024-53
nvd.nist.gov/vuln/detail/CVE-2024-9936
github.com/advisories/GHSA-8c7g-vx5g-cmpg
ubuntu.com/security/CVE-2024-9936
cve.org/CVERecord?id=CVE-2024-9936
Show 194 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/N2GEA6WKXO636ULQP37RVXOL5AETXC2U
suse.com/security/cve/CVE-2024-9936
This page doesn't list everything
Left out here: 73 versions and 37 references. The JSON record has them.