Vulnerability · Published Sep 3, 2024 · Assigned by mozilla
CVE-2024-8382
High 8.8
In plain English
A high-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | firefox | 128.2.0-1.el8_10.alma.1 | ALSA-2024:6682 |
| AlmaLinux:9 | firefox | 128.2.0-1.el9_4.alma.1 | ALSA-2024:6681 |
| AlmaLinux:9 | firefox-x11 | 128.2.0-1.el9_4.alma.1 | ALSA-2024:6681 |
| AlmaLinux:8 | thunderbird | 128.2.0-1.el8_10.alma.1 | ALSA-2024:6684 |
| AlmaLinux:9 | thunderbird | 128.2.0-1.el9_4.alma.1 | ALSA-2024:6683 |
| Debian:12 | firefox-esr | 115.15.0esr-1~deb12u1 | DEBIAN-CVE-2024-8382 |
| Debian:12 | firefox-esr | 115.15.0esr-1~deb12u1 | DSA-5765-1 |
| Debian:13 | firefox-esr | 115.15.0esr-1 | DEBIAN-CVE-2024-8382 |
| Debian:14 | firefox-esr | 115.15.0esr-1 | DEBIAN-CVE-2024-8382 |
| Debian:12 | thunderbird | 1:115.15.0-1~deb12u1 | DSA-5767-1 |
| Debian:12 | thunderbird | 1:115.15.0-1~deb12u1 | DEBIAN-CVE-2024-8382 |
| Debian:13 | thunderbird | 1:128.2.0esr-1 | DEBIAN-CVE-2024-8382 |
| Debian:14 | thunderbird | 1:128.2.0esr-1 | DEBIAN-CVE-2024-8382 |
| Rocky Linux:8 | firefox | 0:128.2.0-1.el8_10 | RLSA-2024:6682 |
| Rocky Linux:9 | firefox | 0:128.2.0-1.el9_4.0.1 | RLSA-2024:6681 |
| Rocky Linux:8 | thunderbird | 0:128.2.0-1.el8_10 | RLSA-2024:6684 |
| Rocky Linux:9 | thunderbird | 0:128.2.0-1.el9_4.0.1 | RLSA-2024:6683 |
| Ubuntu:22.04:LTS | mozjs102 | no fix listed | UBUNTU-CVE-2024-8382 |
| Ubuntu:24.04:LTS | mozjs102 | no fix listed | UBUNTU-CVE-2024-8382 |
| Ubuntu:24.04:LTS | mozjs115 | no fix listed | UBUNTU-CVE-2024-8382 |
| Ubuntu:22.04:LTS | mozjs78 | no fix listed | UBUNTU-CVE-2024-8382 |
| Ubuntu:22.04:LTS | mozjs91 | no fix listed | UBUNTU-CVE-2024-8382 |
| Ubuntu:22.04:LTS | thunderbird | 1:115.15.0+build1-0ubuntu0.22.04.1 | UBUNTU-CVE-2024-8382 |
| Ubuntu:22.04:LTS | thunderbird | 1:115.15.0+build1-0ubuntu0.22.04.1 | USN-6995-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | unspecified – before 130 |
| Mozilla | Firefox ESR | unspecified – before 128.2 |
| Mozilla | Firefox ESR | unspecified – before 115.15 |
| Mozilla | Thunderbird | unspecified – before 128.2 |
| Mozilla | Thunderbird | unspecified – before 115.15 |
Weakness: CWE-273 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1906744
- https://www.mozilla.org/security/advisories/mfsa2024-39/
- https://www.mozilla.org/security/advisories/mfsa2024-40/
- https://www.mozilla.org/security/advisories/mfsa2024-41/
- https://www.mozilla.org/security/advisories/mfsa2024-43/
- https://www.mozilla.org/security/advisories/mfsa2024-44/
- https://lists.debian.org/debian-lts-announce/2024/09/msg00025.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00012.html