CVE-2024-4770: Use After Free
Last updated 24 July 2024
Other sources
When saving a page to PDF, certain font styles could have led to a potential use-after-free crash.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 130.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 115.15.0esr-1~deb11u1Fixed in 115.14.0esr-1~deb12u1Fixed in 115.15.0esr-1~deb12u1Fixed in 115.15.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:115.15.0-1~deb11u1Fixed in 1:115.12.0-1~deb12u1Fixed in 1:115.15.0-1~deb12u1Fixed in 1:128.2.0esr-1Fixed in 1:128.2.1esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.11 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 126 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.11 - Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 115.11 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.11
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-4770?
CVE-2024-4770 has a medium severity rating due to the potential for a use-after-free crash when saving pages to PDF.
How do I fix CVE-2024-4770?
To fix CVE-2024-4770, update your Mozilla Firefox or Thunderbird to the latest version that resolves this vulnerability.
Which products are affected by CVE-2024-4770?
CVE-2024-4770 affects Mozilla Firefox ESR versions up to 115.11 and Mozilla Thunderbird versions up to 115.11.
Can CVE-2024-4770 be exploited remotely?
Yes, CVE-2024-4770 can potentially be exploited remotely through crafted PDF generation processes.
What happens if I don't address CVE-2024-4770?
Failing to address CVE-2024-4770 may result in application crashes and potential exposure to further exploits due to the underlying use-after-free condition.