CVE-2024-7518

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

• Firefox: 115.14/128.1 ESR ()

• mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518)

• mozilla: Out of bounds memory access in graphics shared memory handling (CVE-2024-7519)

• mozilla: Type confusion in WebAssembly (CVE-2024-7520)

• mozilla: Incomplete WebAssembly exception handing (CVE-2024-7521)

• mozilla: Out of bounds read in editor component (CVE-2024-7522)

• mozilla: CSP strict-dynamic bypass using web-compatibility shims (CVE-2024-7524)

• mozilla: Missing permission check when creating a StreamFilter (CVE-2024-7525)

• mozilla: Uninitialized memory used by WebGL (CVE-2024-7526)

• mozilla: Use-after-free in JavaScript garbage collection (CVE-2024-7527)

• mozilla: Use-after-free in IndexedDB (CVE-2024-7528)

• mozilla: Document content could partially obscure security prompts (CVE-2024-7529)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• Thunderbird: 115.14/128.1 ()

• mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518)

• mozilla: Out of bounds memory access in graphics shared memory handling (CVE-2024-7519)

• mozilla: Type confusion in WebAssembly (CVE-2024-7520)

• mozilla: Incomplete WebAssembly exception handing (CVE-2024-7521)

• mozilla: Out of bounds read in editor component (CVE-2024-7522)

• mozilla: Missing permission check when creating a StreamFilter (CVE-2024-7525)

• mozilla: Uninitialized memory used by WebGL (CVE-2024-7526)

• mozilla: Use-after-free in JavaScript garbage collection (CVE-2024-7527)

• mozilla: Use-after-free in IndexedDB (CVE-2024-7528)

• mozilla: Document content could partially obscure security prompts (CVE-2024-7529)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

• Firefox: 115.14/128.1 ESR ()
• mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518)
• mozilla: Out of bounds memory access in graphics shared memory handling (CVE-2024-7519)
• mozilla: Type confusion in WebAssembly (CVE-2024-7520)
• mozilla: Incomplete WebAssembly exception handing (CVE-2024-7521)
• mozilla: Out of bounds read in editor component (CVE-2024-7522)
• mozilla: CSP strict-dynamic bypass using web-compatibility shims (CVE-2024-7524)
• mozilla: Missing permission check when creating a StreamFilter (CVE-2024-7525)
• mozilla: Uninitialized memory used by WebGL (CVE-2024-7526)
• mozilla: Use-after-free in JavaScript garbage collection (CVE-2024-7527)
• mozilla: Use-after-free in IndexedDB (CVE-2024-7528)
• mozilla: Document content could partially obscure security prompts (CVE-2024-7529)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

• Firefox: 115.14/128.1 ESR ()
• mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518)
• mozilla: Out of bounds memory access in graphics shared memory handling (CVE-2024-7519)
• mozilla: Type confusion in WebAssembly (CVE-2024-7520)
• mozilla: Incomplete WebAssembly exception handing (CVE-2024-7521)
• mozilla: Out of bounds read in editor component (CVE-2024-7522)
• mozilla: CSP strict-dynamic bypass using web-compatibility shims (CVE-2024-7524)
• mozilla: Missing permission check when creating a StreamFilter (CVE-2024-7525)
• mozilla: Uninitialized memory used by WebGL (CVE-2024-7526)
• mozilla: Use-after-free in JavaScript garbage collection (CVE-2024-7527)
• mozilla: Use-after-free in IndexedDB (CVE-2024-7528)
• mozilla: Document content could partially obscure security prompts (CVE-2024-7529)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• EMBARGOED Thunderbird: 115.14/128.1 ()
• mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518)
• mozilla: Out of bounds memory access in graphics shared memory handling (CVE-2024-7519)
• mozilla: Type confusion in WebAssembly (CVE-2024-7520)
• mozilla: Incomplete WebAssembly exception handing (CVE-2024-7521)
• mozilla: Out of bounds read in editor component (CVE-2024-7522)
• mozilla: Missing permission check when creating a StreamFilter (CVE-2024-7525)
• mozilla: Uninitialized memory used by WebGL (CVE-2024-7526)
• mozilla: Use-after-free in JavaScript garbage collection (CVE-2024-7527)
• mozilla: Use-after-free in IndexedDB (CVE-2024-7528)
• mozilla: Document content could partially obscure security prompts (CVE-2024-7529)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

• Thunderbird: 115.14/128.1 ()
• mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518)
• mozilla: Out of bounds memory access in graphics shared memory handling (CVE-2024-7519)
• mozilla: Type confusion in WebAssembly (CVE-2024-7520)
• mozilla: Incomplete WebAssembly exception handing (CVE-2024-7521)
• mozilla: Out of bounds read in editor component (CVE-2024-7522)
• mozilla: Missing permission check when creating a StreamFilter (CVE-2024-7525)
• mozilla: Uninitialized memory used by WebGL (CVE-2024-7526)
• mozilla: Use-after-free in JavaScript garbage collection (CVE-2024-7527)
• mozilla: Use-after-free in IndexedDB (CVE-2024-7528)
• mozilla: Document content could partially obscure security prompts (CVE-2024-7529)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• rebase from Thunderbird 115.4.1 to 140.12.0 ESR

• CVE-2022-3032: When receiving an HTML email that contained an iframe element, which used a srcdoc attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked

• CVE-2023-0430: Certificate OCSP revocation status was not checked when verifying S/Mime signatures

• CVE-2023-0547: OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted

• CVE-2023-0616: If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions

• CVE-2023-1945: Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash

• CVE-2023-4573: When receiving rendering data over IPC mStream could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash

• CVE-2023-4574: When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished

• CVE-2023-4575: When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished

• CVE-2023-4577: When UpdateRegExpStatics attempted to access initialStringHeap it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash

• CVE-2023-4578: When calling JS::CheckRegExpSyntax a Syntax Error could have been set which would end in calling convertToRuntimeErrorAndClear. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error

• CVE-2023-4580: Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information

• CVE-2023-4581: Excel .xll add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm

• CVE-2023-5169: A compromised content process could have provided malicious data in a PathRecording resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process

• CVE-2023-5171: During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash

• CVE-2023-5724: Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash

• CVE-2023-5725: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data

• CVE-2023-5732: An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited

• CVE-2023-6204: On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element

• CVE-2023-6205: It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash

• CVE-2023-6206: The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts

• CVE-2023-6207: Ownership…

The updated package provides Firefox 128 for all mandatory arches of Mageia (x86_64, i586 and aarch64), fixing several bugs, including security vulnerabilities, for i586 and aarch64: Fullscreen notification dialog can be obscured by document content. (CVE-2024-7518) Out of bounds memory access in graphics shared memory handling. (CVE-2024-7519) Type confusion in WebAssembly. (CVE-2024-7520) Incomplete WebAssembly exception handing. (CVE-2024-7521) Out of bounds read in editor component. (CVE-2024-7522) CSP strict-dynamic bypass using web-compatibility shims. (CVE-2024-7524) Missing permission check when creating a StreamFilter. (CVE-2024-7525) Uninitialized memory used by WebGL. (CVE-2024-7526) Use-after-free in JavaScript garbage collection. (CVE-2024-7527) Use-after-free in IndexedDB. (CVE-2024-7528) Document content could partially obscure security prompts. (CVE-2024-7529) WASM type confusion involving ArrayTypes. (CVE-2024-8385) Type confusion when looking up a property name in a "with" block. (CVE-2024-8381) Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran. (CVE-2024-8382) links in an external application. (CVE-2024-8383: Firefox did not ask before openings news) Garbage collection could mis-color cross-compartment objects in OOM conditions. (CVE-2024-8384) SelectElements could be shown over another site if popups are allowed. (CVE-2024-8386) Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. (CVE-2024-8387) Compromised content process can bypass site isolation. (CVE-2024-9392) Cross-origin access to PDF contents through multipart responses. (CVE-2024-9393) Cross-origin access to JSON contents through multipart responses. (CVE-2024-9394) Clipboard write permission bypass. (CVE-2024-8900) Potential memory corruption may occur when cloning certain objects. (CVE-2024-9396) Potential directory upload bypass via clickjacking. (CVE-2024-9397) External protocol handlers could be enumerated via popups. (CVE-2024-9398) Specially crafted WebTransport requests could lead to denial of service. (CVE-2024-9399) Potential memory corruption during JIT compilation. (CVE-2024-9400) Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3. (CVE-2024-9401) Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3. (CVE-2024-9402) Use-after-free in Animation timeline. (CVE-2024-9680)

These are all security issues fixed in the MozillaFirefox-129.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox fixes the following issues:

Update to Firefox Extended Support Release 128.1.0 ESR (MFSA 2024-35, bsc#1228648)

• CVE-2024-7518: Fullscreen notification dialog can be obscured by document
• CVE-2024-7519: Out of bounds memory access in graphics shared memory handling
• CVE-2024-7520: Type confusion in WebAssembly
• CVE-2024-7521: Incomplete WebAssembly exception handing
• CVE-2024-7522: Out of bounds read in editor component
• CVE-2024-7524: CSP strict-dynamic bypass using web-compatibility shims
• CVE-2024-7525: Missing permission check when creating a StreamFilter
• CVE-2024-7526: Uninitialized memory used by WebGL
• CVE-2024-7527: Use-after-free in JavaScript garbage collection
• CVE-2024-7528: Use-after-free in IndexedDB
• CVE-2024-7529: Document content could partially obscure security prompts
• CVE-2024-7531: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel

This update for MozillaFirefox fixes the following issues:

Update to Firefox Extended Support Release 128.1.0 ESR (MFSA 2024-35, bsc#1228648)

• CVE-2024-7518: Fullscreen notification dialog can be obscured by document
• CVE-2024-7519: Out of bounds memory access in graphics shared memory handling
• CVE-2024-7520: Type confusion in WebAssembly
• CVE-2024-7521: Incomplete WebAssembly exception handing
• CVE-2024-7522: Out of bounds read in editor component
• CVE-2024-7524: CSP strict-dynamic bypass using web-compatibility shims
• CVE-2024-7525: Missing permission check when creating a StreamFilter
• CVE-2024-7526: Uninitialized memory used by WebGL
• CVE-2024-7527: Use-after-free in JavaScript garbage collection
• CVE-2024-7528: Use-after-free in IndexedDB
• CVE-2024-7529: Document content could partially obscure security prompts
• CVE-2024-7531: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel

This update for MozillaThunderbird fixes the following issues:

• Mozilla Thunderbird 128.2.3 MFSA 2024-43 (bsc#1229821)
  • CVE-2024-8394: Crash when aborting verification of OTR chat.
  • CVE-2024-8385: WASM type confusion involving ArrayTypes.
  • CVE-2024-8381: Type confusion when looking up a property name in a 'with' block.
  • CVE-2024-8382: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran.
  • CVE-2024-8384: Garbage collection could mis-color cross-compartment objects in OOM conditions.
  • CVE-2024-8386: SelectElements could be shown over another site if popups are allowed.
  • CVE-2024-8387: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. MFSA 2024-37 (bsc#1228648)
  • CVE-2024-7518: Fullscreen notification dialog can be obscured by document content.
  • CVE-2024-7519: Out of bounds memory access in graphics shared memory handling.
  • CVE-2024-7520: Type confusion in WebAssembly.
  • CVE-2024-7521: Incomplete WebAssembly exception handing.
  • CVE-2024-7522: Out of bounds read in editor component.
  • CVE-2024-7525: Missing permission check when creating a StreamFilter.
  • CVE-2024-7526: Uninitialized memory used by WebGL.
  • CVE-2024-7527: Use-after-free in JavaScript garbage collection.
  • CVE-2024-7528: Use-after-free in IndexedDB.
  • CVE-2024-7529: Document content could partially obscure security prompts. MFSA 2024-32 (bsc#1226316)
  • CVE-2024-6606: Out-of-bounds read in clipboard component.
  • CVE-2024-6607: Leaving pointerlock by pressing the escape key could be prevented.
  • CVE-2024-6608: Cursor could be moved out of the viewport using pointerlock.
  • CVE-2024-6609: Memory corruption in NSS.
  • CVE-2024-6610: Form validation popups could block exiting full-screen mode.
  • CVE-2024-6600: Memory corruption in WebGL API.
  • CVE-2024-6601: Race condition in permission assignment.
  • CVE-2024-6602: Memory corruption in NSS.
  • CVE-2024-6603: Memory corruption in thread creation.
  • CVE-2024-6611: Incorrect handling of SameSite cookies.
  • CVE-2024-6612: CSP violation leakage when using devtools.
  • CVE-2024-6613: Incorrect listing of stack frames.
  • CVE-2024-6614: Incorrect listing of stack frames.
  • CVE-2024-6604: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13.
  • CVE-2024-6615: Memory safety bugs fixed in Firefox 128 and Thunderbird 128.

Bug fixes:

• Recommend libfido2-udev in order to try to get security keys (e.g. Yubikeys) working out of the box. (bsc#1184272)

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2024-7518, CVE-2024-7521, CVE-2024-7524, CVE-2024-7526, CVE-2024-7527, CVE-2024-7528, CVE-2024-7529, CVE-2024-7530, CVE-2024-7531)

It was discovered that Firefox did not properly manage certain memory operations when processing graphics shared memory. An attacker could potentially exploit this issue to escape the sandbox. (CVE-2024-7519)

Nan Wang discovered that Firefox did not properly handle type check in WebAssembly. An attacker could potentially exploit this issue to execute arbitrary code. (CVE-2024-7520)

Irvan Kurniawan discovered that Firefox did not properly check an attribute value in the editor component, leading to an out-of-bounds read vulnerability. An attacker could possibly use this issue to cause a denial of service or expose sensitive information. (CVE-2024-7522)

Rob Wu discovered that Firefox did not properly check permissions when creating a StreamFilter. An attacker could possibly use this issue to modify response body of requests on any site using a web extension. (CVE-2024-7525)