CVE-2024-9396: Buffer Overflow
It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to memory corruption.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 131 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 131 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 128.3 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.3.0esr-1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.3
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-9396?
The severity of CVE-2024-9396 is currently undetermined pending further investigation into its exploitability.
How do I fix CVE-2024-9396?
To mitigate CVE-2024-9396, users should update affected Mozilla products to the latest versions provided by the vendor.
Which software is affected by CVE-2024-9396?
CVE-2024-9396 affects Mozilla Thunderbird, Firefox, and Firefox ESR versions up to 131 and 128.3 respectively.
Is CVE-2024-9396 currently being exploited in the wild?
As of now, it is unknown if CVE-2024-9396 is actively being exploited.
What kind of vulnerability is CVE-2024-9396?
CVE-2024-9396 is potentially a memory corruption vulnerability related to the structured cloning of certain objects.