CVE-2024-3857: Use After Free

Reference Links

• https://www.mozilla.org/en-US/security/advisories/mfsa2024-19/#CVE-2024-3857
• https://access.redhat.com/errata/RHSA-2024:1904
• https://access.redhat.com/errata/RHSA-2024:1905
• https://access.redhat.com/errata/RHSA-2024:1907
• https://access.redhat.com/errata/RHSA-2024:1908
• https://access.redhat.com/errata/RHSA-2024:1906
• https://access.redhat.com/errata/RHSA-2024:1909
• https://access.redhat.com/errata/RHSA-2024:1911
• https://access.redhat.com/errata/RHSA-2024:1912
• https://access.redhat.com/errata/RHSA-2024:1910
• https://bugzilla.redhat.com/show_bug.cgi?id=2275550
• https://bugzilla.mozilla.org/show_bug.cgi?id=1886683
• https://www.mozilla.org/en-US/security/advisories/mfsa2024-19/
• https://www.mozilla.org/en-US/security/advisories/mfsa2024-20/
• https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html
• https://www.mozilla.org/security/advisories/mfsa2024-18/
• https://www.mozilla.org/security/advisories/mfsa2024-19/
• https://www.mozilla.org/security/advisories/mfsa2024-20/
• https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html
• https://launchpad.net/bugs/cve/CVE-2024-3857
• https://www.mozilla.org/en-US/security/advisories/mfsa2024-18/
• https://www.mozilla.org/en-US/security/advisories/mfsa2024-18/#CVE-2024-3857
• https://www.mozilla.org/en-US/security/advisories/mfsa2024-20/#CVE-2024-3857
• https://security-tracker.debian.org/tracker/CVE-2024-3857
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3857
• https://nvd.nist.gov/vuln/detail/CVE-2024-3857
• https://ubuntu.com/security/CVE-2024-3857

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2024-20
• MFSA2024-18
• MFSA2024-19

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2024-3852
• CVE-2024-3854
• CVE-2024-3857
• CVE-2024-2609
• CVE-2024-3859
• CVE-2024-3861
• CVE-2024-3863
• CVE-2024-3302
• CVE-2024-3864
• CVE-2024-5702
• CVE-2024-3853
• CVE-2024-3855
• CVE-2024-3856
• CVE-2024-3858
• CVE-2024-3860
• CVE-2024-3862
• CVE-2024-3865

Frequently Asked Questions

• What is the severity of CVE-2024-3857?

  CVE-2024-3857 has the potential for significant impact as it may lead to use-after-free crashes in affected software.

• How do I fix CVE-2024-3857?

  To fix CVE-2024-3857, update to the latest versions of the affected software, such as Firefox and Thunderbird, specifically beyond version 115.10.

• Which products are affected by CVE-2024-3857?

  CVE-2024-3857 affects versions of Firefox, Thunderbird, Firefox ESR, and the corresponding Debian packages up to version 115.10.

• What causes the CVE-2024-3857 vulnerability?

  The vulnerability in CVE-2024-3857 is caused by the JIT compiler generating incorrect code for arguments, resulting in potential crashes.

• How can I check if my software is affected by CVE-2024-3857?

  You can check if your software is affected by CVE-2024-3857 by comparing your installed version of Firefox or Thunderbird against the mentioned vulnerable versions.