CVE-2024-3302

Katalog CVE

CVSS 3.7 · Low EPSS 0,77%

Kerentanan Allocation of Resources Without Limits or Throttling pada mozilla firefox, mozilla thunderbird. Skor CVSS 3.1 3.7 (Low) menurut CISA ADP.

Deskripsi (NVD)

There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

Rincian

Terbit di NVD

16 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mozilla.org/security/advisories/mfsa2024-18/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2024-19/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2024-20/ advisory vendor
• https://kb.cert.org/vuls/id/421644 pemerintah AS
• https://bugzilla.mozilla.org/show_bug.cgi?id=1881183 issue tracking
• https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html mailing list
• https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html mailing list