RHSA-2024:9554HighCVSS 9.8

Red Hat Security Advisory: firefox security update

Published
November 13, 2024
Last Modified
November 5, 2026

🔗 CVE IDs covered (11)

CVE-2024-10461 →CVE-2024-10462 →CVE-2024-10465 →CVE-2024-10467 →CVE-2024-9680 →CVE-2024-10460 →CVE-2024-10463 →CVE-2024-10464 →CVE-2024-10466 →CVE-2024-10458 →CVE-2024-10459 →

📋 Description

CVE-2024-9680 — firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) CVE-2024-10458 — firefox: thunderbird: Permission leak via embed or object elements CVE-2024-10459 — firefox: thunderbird: Use-after-free in layout with accessibility CVE-2024-10460 — firefox: thunderbird: Confusing display of origin for external protocol handler prompt CVE-2024-10461 — firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response CVE-2024-10462 — firefox: thunderbird: Origin of permission prompt could be spoofed by long URL CVE-2024-10463 — firefox: thunderbird: Cross origin video frame leak CVE-2024-10464 — firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser CVE-2024-10465 — firefox: thunderbird: Clipboard "paste" button persisted across tabs CVE-2024-10466 — firefox: DOM push subscription message could hang Firefox CVE-2024-10467 — firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4

🎯 Affected products18

  • Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-0:128.4.0-1.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-0:128.4.0-1.el9_5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-0:128.4.0-1.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-0:128.4.0-1.el9_5.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-0:128.4.0-1.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debuginfo-0:128.4.0-1.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debuginfo-0:128.4.0-1.el9_5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debuginfo-0:128.4.0-1.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debuginfo-0:128.4.0-1.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debugsource-0:128.4.0-1.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debugsource-0:128.4.0-1.el9_5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debugsource-0:128.4.0-1.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debugsource-0:128.4.0-1.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-x11-0:128.4.0-1.el9_5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-x11-0:128.4.0-1.el9_5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-x11-0:128.4.0-1.el9_5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-x11-0:128.4.0-1.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

🔗 References (14)