Red Hat Security Advisory

RHSA-2024:7505

firefox security update

Released 2024-10-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) firefox-128.3.0-1.el9_4, firefox-x11-128.3.0-1.el9_4

TI-2024-08724 CVE-2024-9402 · GHSA-r28p-rpv4-w54r

MEDIUM 50

Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00615 Published 2024-10-01 Partial fix · 131, 128.3 CWE-119

TI-2024-08723 CVE-2024-9401 · GHSA-fc27-6qvc-xq94

MEDIUM 50

Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00739 Published 2024-10-01 Partial fix · 131, 128.3 +1 CWE-119

TI-2024-08714 CVE-2024-9392 · GHSA-hc6r-wpfc-q7m8

MEDIUM 50

A compromised content process could have allowed for the arbitrary loading of cross-origin pages.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00535 Published 2024-10-01 Partial fix · 131, 128.3 +1 CWE-346

TI-2024-08715 CVE-2024-9393 · GHSA-rggh-rm3v-8xqj

LOW 39

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00397 Published 2024-10-01 Partial fix · 131, 128.3 +1 CWE-346

TI-2024-08716 CVE-2024-9394 · GHSA-qph8-rvxf-5936

LOW 33

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00521 Published 2024-10-01 Partial fix · 131, 128.3 +1 CWE-79