Bug 932374 (CVE-2024-4764, CVE-2024-4765, CVE-2024-4766, CVE-2024-4771, CVE-2024-4772, CVE-2024-4773, CVE-2024-4774, CVE-2024-4775, CVE-2024-4776, CVE-2024-4778)

Summary:	<www-client/firefox{-bin,}-{115.11.0,126.0}: multiple vulnerabilities
Product:	Gentoo Security	Reporter:	Christopher Fore <csfore>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	major	CC:	mozilla
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://www.mozilla.org/en-US/security/advisories/mfsa2024-21/
Whiteboard:	A2 [glsa+]
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	930379

Description Christopher Fore 2024-05-21 15:32:58 UTC

The following only affect rapid (126.0):

CVE-2024-4764:

Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free.


CVE-2024-4771:

A memory allocation check was missing which would lead to a use-after-free if the allocation failed. This could have triggered a crash or potentially be leveraged to achieve code execution.


CVE-2024-4772:

An HTTP digest authentication nonce value was generated using rand() which could lead to predictable values.


CVE-2024-4773:

When a network error occurred during page load, the prior content could have remained in view with a blank URL bar. This could have been used to obfuscate a spoofed web site.


CVE-2024-4774:

The ShmemCharMapHashEntry() code was susceptible to potentially undefined behavior by bypassing the move semantics for one of its data members.


CVE-2024-4775:

An iterator stop condition was missing when handling WASM code in the built-in profiler, potentially leading to invalid memory access and undefined behavior. Note: This issue only affects the application when the profiler is running.


CVE-2024-4776:

A file dialog shown while in full-screen mode could have resulted in the window remaining disabled.


CVE-2024-4778:

Memory safety bugs present in Firefox 125. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.



Please bump the -bin package for ESR.

Comment 1 Joonas Niilola gentoo-dev

2024-07-13 08:00:37 UTC

This is done.

Comment 2 Larry the Git Cow gentoo-dev

2024-08-06 05:41:06 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=4ebaf5fd697ce534e95ea08df9014968d851d710

commit 4ebaf5fd697ce534e95ea08df9014968d851d710
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2024-08-06 05:40:35 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2024-08-06 05:41:04 +0000

    [ GLSA 202408-02 ] Mozilla Firefox: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/930380
    Bug: https://bugs.gentoo.org/932374
    Bug: https://bugs.gentoo.org/935550
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 glsa-202408-02.xml | 110 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 110 insertions(+)