CVE-2024-3859

Katalog CVE

CVSS 5.9 · Medium EPSS 0,67%

Kerentanan Out-of-bounds Read pada mozilla firefox, mozilla thunderbird +1 lainnya. Skor CVSS 3.1 5.9 (Medium) menurut CISA ADP.

Deskripsi (NVD)

On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered by a malformed OpenType font. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

Rincian

Terbit di NVD

16 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read
CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mozilla.org/security/advisories/mfsa2024-18/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2024-19/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2024-20/ advisory vendor
• https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html mailing list · advisory pihak ketiga
• https://bugzilla.mozilla.org/show_bug.cgi?id=1874489 issue tracking