Mozilla Firefox Use-After-Free Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2024-10-15
• Known to be used in ransomware campaigns
• EPSS: 23% chance of exploitation in the next 30 days (higher than 98% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

CISA: Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 5 Nov 2024): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

• Patch on msrc.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• bugzilla.mozilla.org/show_bug.cgiIssue TrackingPermissions Required
• msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039Not ApplicablePatchVendor Advisory
• www.mozilla.org/security/advisories/mfsa2024-51Vendor Advisory
• www.mozilla.org/security/advisories/mfsa2024-52Vendor Advisory
• bugs.freebsd.org/bugzilla/show_bug.cgiIssue Tracking
• lists.debian.org/debian-lts-announce/2024/10/msg00005.htmlMailing List
• lists.debian.org/debian-lts-announce/2024/10/msg00006.htmlMailing List
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource