CVE-2024-2610: Code Injection

Q: What is the severity of CVE-2024-2610?

CVE-2024-2610 is classified as a high-severity vulnerability due to its potential to bypass strict content security policies.

Q: How do I fix CVE-2024-2610?

To fix CVE-2024-2610, update affected software to the latest versions specified in the vendor's advisory.

Q: Which software is affected by CVE-2024-2610?

CVE-2024-2610 affects Mozilla Firefox versions up to 124, Firefox ESR versions up to 115.9, and Thunderbird versions up to 115.9.

Q: Can CVE-2024-2610 lead to data theft?

Yes, CVE-2024-2610 can potentially allow attackers to steal nonce values, leading to data theft.

Q: Is CVE-2024-2610 associated with markup injection?

Yes, CVE-2024-2610 is a markup injection vulnerability that enables attackers to exploit nonce values.

Published Mar 19, 2024

Updated

Last updated 24 July 2024

Other sources

Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass strict content security policies.

— Mozilla

Affected Software

19 affected componentsFixes available

Mozilla Thunderbird<115.9

115.9

Mozilla Firefox<124

124

Mozilla Firefox ESR<115.9

115.9

Mozilla Firefox<115.9.0

Mozilla Firefox<124.0

Mozilla Thunderbird<115.9.0

redhat/firefox<115.9

115.9

redhat/thunderbird<115.9

115.9

debian/firefox-esr<115.9.0esr-1~deb12u1

115.9.0esr-1~deb12u1

debian/firefox-esr<115.9.0esr-1

115.9.0esr-1

debian/firefox-esr<115.9.0esr-1

115.9.0esr-1

debian/thunderbird<1:115.9.0-1~deb12u1

1:115.9.0-1~deb12u1

debian/thunderbird<1:115.9.0-1

1:115.9.0-1

debian/thunderbird<1:115.9.0-1

1:115.9.0-1

alpine/firefox-esr<115.9.0-r0

115.9.0-r0

alpine/firefox-esr<115.9.0-r0

115.9.0-r0

debian/firefox

160.0-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.7.0esr-1~deb12u1140.15.0esr-1~deb13u1153.7.0esr-1~deb13u1153.5.1esr-1153.7.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.7.0esr-1~deb12u11:140.12.0esr-1~deb13u11:153.7.0esr-1~deb13u11:153.5.0esr-11:153.7.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 115.9
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 124
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.9
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 115.9
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 115.9
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.9.0esr-1~deb12u1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.9.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.9.0-1~deb12u1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.9.0-1
Upgrade
Upgrade alpine/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.9.0-r0
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 160.0-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 140.12.0esr-1~deb12u1Fixed in 153.7.0esr-1~deb12u1Fixed in 140.15.0esr-1~deb13u1Fixed in 153.7.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.7.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.7.0esr-1~deb12u1Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.7.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1
Upgrade
Upgrade Mozilla Firefox to a version that resolves this vulnerability.
Fixed in 124
Upgrade
Upgrade Mozilla Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.9
Upgrade
Upgrade Mozilla Thunderbird to a version that resolves this vulnerability.
Fixed in 115.9

Event History

Mar 19, 2024

CVE Published

via Mozilla·12:00 AM

CVE Published

via MITRE·12:02 PM

Data Sourced

via MITRE·12:02 PM

DescriptionWeakness

Data Sourced

via OSV·12:15 PM

DescriptionSeverityAffected Software

Mar 21, 2024

Data Sourced

via Red Hat·10:37 AM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-2610?

CVE-2024-2610 is classified as a high-severity vulnerability due to its potential to bypass strict content security policies.

How do I fix CVE-2024-2610?

To fix CVE-2024-2610, update affected software to the latest versions specified in the vendor's advisory.

Which software is affected by CVE-2024-2610?

CVE-2024-2610 affects Mozilla Firefox versions up to 124, Firefox ESR versions up to 115.9, and Thunderbird versions up to 115.9.

Can CVE-2024-2610 lead to data theft?

Yes, CVE-2024-2610 can potentially allow attackers to steal nonce values, leading to data theft.

Is CVE-2024-2610 associated with markup injection?

Yes, CVE-2024-2610 is a markup injection vulnerability that enables attackers to exploit nonce values.

CVE-2024-2610: Code Injection

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-2610?

How do I fix CVE-2024-2610?

Which software is affected by CVE-2024-2610?

Can CVE-2024-2610 lead to data theft?

Is CVE-2024-2610 associated with markup injection?

Company

Resources

Contact