Read the docs
TI-2024-08981 Aliases CVE-2024-9680GHSA-hm3j-qgpw-pj98

Use after free in Mozilla Firefox

Priority CRITICAL 100Exploited in the wildCWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 13 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

Why it matters now

Exploitation Active In CISA KEV since 2024-10-15CISA due date 2024-11-05Known ransomware use
EPSS 0.23184 97th percentileScored 2026-11-07
Fix Partial Firefox (Mozilla): 131.0.2Firefox ESR (Mozilla): 128.3.1, 115.16.1+1 more productRed Hat: 19 advisoriesRed Hat: 13 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MozillaFirefoxbefore 131.0.2131.0.2Patch availableCNA
MozillaFirefox ESRbefore 128.3.1128.3.1Patch availableCNA
MozillaFirefox ESRbefore 115.16.1115.16.1Patch availableCNA
MozillaThunderbirdbefore 131.0.1131.0.1Patch availableCNA
MozillaThunderbirdbefore 128.3.1128.3.1Patch availableCNA
MozillaThunderbirdbefore 115.16.0115.16.0Patch availableCNA
  • Firefox VendorMozilla Affected before 131.0.2 Fixed in 131.0.2 Patch available CNA
  • Firefox ESR VendorMozilla Affected before 128.3.1 Fixed in 128.3.1 Patch available CNA
  • Firefox ESR VendorMozilla Affected before 115.16.1 Fixed in 115.16.1 Patch available CNA
  • Thunderbird VendorMozilla Affected before 131.0.1 Fixed in 131.0.1 Patch available CNA
  • Thunderbird VendorMozilla Affected before 128.3.1 Fixed in 128.3.1 Patch available CNA
  • Thunderbird VendorMozilla Affected before 115.16.0 Fixed in 115.16.0 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*before 115.16.1VulnerableMozilla
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*before 131.0.2VulnerableMozilla
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*128.1.0 to before 128.3.1VulnerableMozilla
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*before 115.16.0; 128.0.1 to before 128.3.1VulnerableMozilla
cpe:2.3:a:mozilla:thunderbird:131.0:*:*:*:*:*:*:*131.0VulnerableMozilla
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* Versions before 115.16.1 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* Versions before 131.0.2 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* Versions 128.1.0 to before 128.3.1 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* Versions before 115.16.0; 128.0.1 to before 128.3.1 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:thunderbird:131.0:*:*:*:*:*:*:* Versions 131.0 Vulnerable ·Mozilla
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA Firefox (Mozilla) Fixed in 131.0.2
  • Fix · CNA Firefox ESR (Mozilla) Fixed in 128.3.1
  • Fix · CNA Firefox ESR (Mozilla) Fixed in 115.16.1
  • Fix · CNA Thunderbird (Mozilla) Fixed in 131.0.1
  • Fix · CNA Thunderbird (Mozilla) Fixed in 128.3.1
  • Fix · CNA Thunderbird (Mozilla) Fixed in 115.16.0

Red Hat 19 advisories

  • RHSA-2024:9554 Released 2024-11-13 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 9) firefox-128.4.0-1.el9_5, firefox-x11-128.4.0-1.el9_5
  • RHSA-2024:9552 Released 2024-11-13 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 9) thunderbird-128.4.0-1.el9_5
  • RHSA-2024:8176 Released 2024-10-16 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) firefox-128.3.1-2.el8_2
Show 16 more Red Hat advisories
  • RHSA-2024:8166 Released 2024-10-16 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) thunderbird-128.3.1-1.el8_8
  • RHSA-2024:8167 Released 2024-10-16 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox-128.3.1-2.el8_4
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) firefox-128.3.1-2.el8_4
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) firefox-128.3.1-2.el8_4
  • RHSA-2024:8131 Released 2024-10-15 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) firefox-128.3.1-2.el8_6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) firefox-128.3.1-2.el8_6
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) firefox-128.3.1-2.el8_6
  • RHSA-2024:8033 Released 2024-10-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) firefox-128.3.1-2.el8_8
  • RHSA-2024:8034 Released 2024-10-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) firefox-128.3.1-2.el7_9
  • RHSA-2024:8025 Released 2024-10-14 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 9) thunderbird-128.3.1-1.el9_4
  • RHSA-2024:8024 Released 2024-10-14 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 8) thunderbird-128.3.1-1.el8_10
  • RHSA-2024:8032 Released 2024-10-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) firefox-128.3.1-2.el9_0
  • RHSA-2024:8031 Released 2024-10-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) firefox-128.3.1-2.el9_2, firefox-x11-128.3.1-2.el9_2
  • RHSA-2024:8028 Released 2024-10-14 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) thunderbird-128.3.1-1.el8_6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) thunderbird-128.3.1-1.el8_6
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) thunderbird-128.3.1-1.el8_6
  • RHSA-2024:8029 Released 2024-10-14 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) thunderbird-128.3.1-1.el8_4
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) thunderbird-128.3.1-1.el8_4
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) thunderbird-128.3.1-1.el8_4
  • RHSA-2024:8026 Released 2024-10-14 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) thunderbird-128.3.1-1.el9_2
  • RHSA-2024:8030 Released 2024-10-14 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) thunderbird-128.3.1-1.el8_2
  • RHSA-2024:8027 Released 2024-10-14 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) thunderbird-128.3.1-1.el9_0
  • RHSA-2024:7977 Released 2024-10-10 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 8) firefox-128.3.1-2.el8_10
  • RHSA-2024:7958 Released 2024-10-10 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 9) firefox-128.3.1-2.el9_4, firefox-x11-128.3.1-2.el9_4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:7977, RHSA-2024:8024
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:7958, RHSA-2024:8025, RHSA-2024:9552, RHSA-2024:9554
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2024:8030, RHSA-2024:8176
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:8029, RHSA-2024:8167
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2024:8028, RHSA-2024:8131
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:8029, RHSA-2024:8167
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2024:8028, RHSA-2024:8131
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2024:8027, RHSA-2024:8032
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:8033, RHSA-2024:8166
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:8026, RHSA-2024:8031
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:8029, RHSA-2024:8167
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2024:8028, RHSA-2024:8131
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2024:8034
Not affected: 1 product
  • Red Hat Enterprise Linux 10

Timeline

  1. 2024-10-15 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2024-9680
  3. 2026-10-03 Alias added: GHSA-hm3j-qgpw-pj98

References

Patch 1

Advisory 2

Other 1

  • TI-2022-09832 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.6
  • TI-2019-08769 Improper input validation in Mozilla Firefox ESR KEVCVSS 3.1CRITICAL 10.0
  • TI-2010-03577 Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-04799 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
  • TI-2023-04477 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
  • TI-2022-09831 Use after free in Mozilla Firefox KEVCVSS 3.1HIGH 8.8
See all 3444 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences