CVE-2024-6612: CSP violation leakage when using devtools
CSP violations generated links in the console tab of the developer tools, pointing to the violating resource. This caused a DNS prefetch which leaked that a CSP violation happened.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 131.0.2-2 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 128 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 128 - Upgrade
Upgrade
Firefox and Thunderbirdto a version that resolves this vulnerability.Fixed in 128 - Operational
Ensure DNS prefetch does not leak CSP violation details by updating affected Firefox/Thunderbird instances to a version that is not less than 128.
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-6612?
CVE-2024-6612 is rated as having a moderate severity due to the potential information disclosure through CSP violations.
How do I fix CVE-2024-6612?
To fix CVE-2024-6612, update Mozilla Thunderbird or Firefox to version 128 or higher.
Which versions of Firefox are affected by CVE-2024-6612?
CVE-2024-6612 affects Firefox versions up to but not including 128.
Which versions of Thunderbird are affected by CVE-2024-6612?
CVE-2024-6612 affects Thunderbird versions up to but not including 128.
Is there a Debian package affected by CVE-2024-6612?
Yes, the Debian package 'firefox' is affected by CVE-2024-6612 prior to version 131.0.2-2.