CVE-2024-6601: Race condition in permission assignment

Q: What is the severity of CVE-2024-6601?

CVE-2024-6601 has been classified as a high-severity vulnerability due to the potential for cross-origin exploitation.

Q: How do I fix CVE-2024-6601?

To fix CVE-2024-6601, upgrade to Firefox version 128 or Thunderbird version 128, or apply the latest security updates provided by your distribution.

Q: Which versions of Firefox are affected by CVE-2024-6601?

CVE-2024-6601 affects Firefox versions prior to 128 and Firefox ESR versions prior to 115.13.

Q: Which users are at risk from CVE-2024-6601?

Users running affected versions of Firefox or Thunderbird are at risk of CVE-2024-6601 due to a race condition that could permit unauthorized access.

Q: Is CVE-2024-6601 exploitable remotely?

Yes, CVE-2024-6601 is exploitable remotely, making it particularly concerning for users of affected software.

Published Jul 9, 2024

Updated

A race condition could lead to a cross-origin container obtaining permissions of the top-level origin.

Affected Software

12 affected componentsFixes available

redhat/firefox<115.13

115.13

redhat/thunderbird<115.13

115.13

debian/firefox

131.0.2-2

debian/firefox-esr

115.14.0esr-1~deb11u1128.3.1esr-1~deb11u1115.14.0esr-1~deb12u1128.3.1esr-1~deb12u1128.3.0esr-2128.3.1esr-2

debian/thunderbird<=1:115.12.0-1~deb11u1, <=1:115.12.0-1~deb12u1

1:115.16.0esr-1~deb11u11:115.16.0esr-1~deb12u11:128.2.0esr-11:128.3.0esr-1

Mozilla Thunderbird<115.13

115.13

Mozilla Thunderbird<128

128

Mozilla Firefox<128

128

Mozilla Firefox ESR<115.13

115.13

Mozilla Firefox<128.0

Mozilla Thunderbird<128.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 115.13
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 115.13
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 131.0.2-2
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.14.0esr-1~deb11u1Fixed in 128.3.1esr-1~deb11u1Fixed in 115.14.0esr-1~deb12u1Fixed in 128.3.1esr-1~deb12u1Fixed in 128.3.0esr-2Fixed in 128.3.1esr-2
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.16.0esr-1~deb11u1Fixed in 1:115.16.0esr-1~deb12u1Fixed in 1:128.2.0esr-1Fixed in 1:128.3.0esr-1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 115.13
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 128
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 128
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.13
Upgrade
Upgrade Mozilla Firefox to a version that resolves this vulnerability.
Fixed in 128
Upgrade
Upgrade Mozilla Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.13
Upgrade
Upgrade Mozilla Thunderbird to a version that resolves this vulnerability.
Fixed in 128
Upgrade
Upgrade Mozilla Thunderbird to a version that resolves this vulnerability.
Fixed in 115.13

Event History

Jul 9, 2024

CVE Published

via Mozilla·12:00 AM

CVE Published

via MITRE·02:25 PM

Data Sourced

via MITRE·02:25 PM

Description

Data Sourced

via NVD·03:15 PM

Description

Data Sourced

via NVD·03:15 PM

SeverityWeaknessAffected Software

Sep 16, 2024

Data Sourced

via Ubuntu·08:53 AM

RemedyDescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-6601?

CVE-2024-6601 has been classified as a high-severity vulnerability due to the potential for cross-origin exploitation.

How do I fix CVE-2024-6601?

To fix CVE-2024-6601, upgrade to Firefox version 128 or Thunderbird version 128, or apply the latest security updates provided by your distribution.

Which versions of Firefox are affected by CVE-2024-6601?

CVE-2024-6601 affects Firefox versions prior to 128 and Firefox ESR versions prior to 115.13.

Which users are at risk from CVE-2024-6601?

Users running affected versions of Firefox or Thunderbird are at risk of CVE-2024-6601 due to a race condition that could permit unauthorized access.

Is CVE-2024-6601 exploitable remotely?

Yes, CVE-2024-6601 is exploitable remotely, making it particularly concerning for users of affected software.

CVE-2024-6601: Race condition in permission assignment

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-6601?

How do I fix CVE-2024-6601?

Which versions of Firefox are affected by CVE-2024-6601?

Which users are at risk from CVE-2024-6601?

Is CVE-2024-6601 exploitable remotely?

Company

Resources

Contact