CVE-2024-7652: Type Confusion in Async Generators in Javascript Engine

Q: What is the severity of CVE-2024-7652?

CVE-2024-7652 is classified as a high severity vulnerability due to its potential for memory corruption and exploitable crashes.

Q: How do I fix CVE-2024-7652?

To fix CVE-2024-7652, update affected software such as Mozilla Firefox ESR to version 115.13 or later, or Mozilla Thunderbird to version 115.13 or later.

Q: Which products are affected by CVE-2024-7652?

CVE-2024-7652 affects Mozilla Firefox versions up to 128, Mozilla Firefox ESR versions up to 115.13, and Thunderbird versions up to 128.

Q: What types of vulnerabilities does CVE-2024-7652 relate to?

CVE-2024-7652 is related to a type confusion error in the ECMA-262 specification that impacts Async Generators.

Q: Are there any known exploits for CVE-2024-7652?

As of now, there are no publicly known exploits specifically targeting CVE-2024-7652.

Published Jul 9, 2024

Updated

An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash.

Affected Software

17 affected componentsFixes available

Mozilla Thunderbird<128

128

Mozilla Firefox<115.13.0

Mozilla Firefox<128.0

Mozilla Thunderbird<115.13.0

Mozilla Thunderbird>=116.0<128.0

debian/firefox

159.0-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.6.0esr-1~deb12u2140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.6.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u21:140.12.0esr-1~deb13u11:153.6.0esr-1~deb13u11:153.5.0esr-11:153.6.0esr-1

Mozilla Firefox<128

128

Mozilla Firefox ESR<115.13

115.13

Mozilla Thunderbird<115.13

115.13

debian/firefox-esr<115.13.0esr-1~deb12u1

115.13.0esr-1~deb12u1

debian/firefox-esr<115.13.0esr-1

115.13.0esr-1

debian/firefox-esr<115.13.0esr-1

115.13.0esr-1

debian/thunderbird<1:115.13.0-1~deb12u1

1:115.13.0-1~deb12u1

debian/thunderbird<1:115.13.0-1

1:115.13.0-1

debian/thunderbird<1:115.13.0-1

1:115.13.0-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 128
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 159.0-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 115.13
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.13.0esr-1~deb12u1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.13.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.13.0-1~deb12u1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.13.0-1

Event History

Jul 9, 2024

CVE Published

via Mozilla·12:00 AM

Data Sourced

via Mozilla·12:00 AM

DescriptionSeverityAffected Software

Sep 6, 2024

CVE Published

via MITRE·06:18 PM

Data Sourced

via MITRE·06:18 PM

Description

Data Sourced

via OSV·07:15 PM

DescriptionSeverityAffected Software

Data Sourced

via Red Hat·07:20 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-7652?

CVE-2024-7652 is classified as a high severity vulnerability due to its potential for memory corruption and exploitable crashes.

How do I fix CVE-2024-7652?

To fix CVE-2024-7652, update affected software such as Mozilla Firefox ESR to version 115.13 or later, or Mozilla Thunderbird to version 115.13 or later.

Which products are affected by CVE-2024-7652?

CVE-2024-7652 affects Mozilla Firefox versions up to 128, Mozilla Firefox ESR versions up to 115.13, and Thunderbird versions up to 128.

What types of vulnerabilities does CVE-2024-7652 relate to?

CVE-2024-7652 is related to a type confusion error in the ECMA-262 specification that impacts Async Generators.

Are there any known exploits for CVE-2024-7652?

As of now, there are no publicly known exploits specifically targeting CVE-2024-7652.

CVE-2024-7652: Type Confusion in Async Generators in Javascript Engine

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-7652?

How do I fix CVE-2024-7652?

Which products are affected by CVE-2024-7652?

What types of vulnerabilities does CVE-2024-7652 relate to?

Are there any known exploits for CVE-2024-7652?

Company

Resources

Contact