Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11. — CVE-2024-4777

Zusammenfassung

Sicherheitshinweis CVE-2024-4777. Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory… Hersteller: Microsoft. Quelle: MSRC. Risiko: high. CVSS 7.5. Details in…

Was tun?

Allgemeine, vorsichtige Schritte (bitte prüfe die offizielle Quelle für Details):

• Priorisiere sofort Patches oder Mitigations (hohes akutes Risiko).
• Identifiziere betroffene Produktversionen und prüfe, ob du betroffen bist.
• Spiele Hersteller-Updates/Patches ein oder setze empfohlene Mitigations um.
• Lies das offizielle Advisory für betroffene Versionen und konkrete Schritte.

Offizielles Advisory

Zur offiziellen Quelle

Mehr dazu

• An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow. CVE-2024-34402
• Azure Monitor Agent Elevation of Privilege Vulnerability CVE-2024-30060
• Bluetooth: msft: fix slab-use-after-free in msft_do_close() CVE-2024-36012
• btrfs: fix information leak in btrfs_ioctl_logical_to_ino() CVE-2024-35849
• btrfs: make sure that WRITTEN is set on all metadata blocks CVE-2024-35949
• crypto: iaa - Fix nr_cpus < nr_iaa case CVE-2024-26945
• crypto: sun8i-ce - Fix use after free in unprepare CVE-2024-27061
• Denial of service when trying to parse malformed POST requests in aiohttp CVE-2024-30251
• Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails CVE-2024-36913
• Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl CVE-2024-36912
• drm/amd: check num of link levels when update pcie param CVE-2023-52812
• drm/amd/display: Skip on writeback when it's not applicable CVE-2024-36914