CVE-2024-5702: Use After Free
Last updated 24 July 2024
Other sources
Memory corruption in the networking stack could have led to a potentially exploitable crash.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.12 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 125 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.12 - Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 115.12 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.12 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.12.0esr-1~deb12u1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.12.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb12u1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.7.0esr-1~deb12u1Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.7.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1 - Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 125 - Upgrade
Upgrade
Mozilla Firefox ESRto a version that resolves this vulnerability.Fixed in 115.12 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 115.12
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2024-5702
- CVE-2024-5688
- CVE-2024-5690
- CVE-2024-5691
- CVE-2024-5692
- CVE-2024-5693
- CVE-2024-5696
- CVE-2024-5700
- CVE-2024-3852
- CVE-2024-3853
- CVE-2024-3854
- CVE-2024-3855
- CVE-2024-3856
- CVE-2024-3857
- CVE-2024-3858
- CVE-2024-3859
- CVE-2024-3860
- CVE-2024-3861
- CVE-2024-3862
- CVE-2024-3863
- CVE-2024-3302
- CVE-2024-3864
- CVE-2024-3865
- DLA-3825-1
- DLA-3836-1
Frequently Asked Questions
What is the severity of CVE-2024-5702?
CVE-2024-5702 is classified as a potentially exploitable crash due to memory corruption in the networking stack.
How do I fix CVE-2024-5702?
To fix CVE-2024-5702, upgrade to the latest version of Firefox, Firefox ESR, or Thunderbird that has patched this vulnerability.
Which versions of Mozilla products are affected by CVE-2024-5702?
CVE-2024-5702 affects Firefox versions before 125, Firefox ESR versions before 115.12, and Thunderbird versions before 115.12.
Can CVE-2024-5702 be exploited remotely?
CVE-2024-5702 has the potential to be exploited remotely, leading to a crash of the affected application.
What should I do if I can't update my software to mitigate CVE-2024-5702?
If unable to update, consider applying additional security measures such as disabling network features or using an alternative application until an update can be performed.