CVE-2024-9400: Buffer Overflow
A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 131 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 131 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 128.3 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.3.0esr-1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.3
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-9400?
The severity of CVE-2024-9400 is classified as a memory corruption vulnerability that can be potentially exploited.
How do I fix CVE-2024-9400?
To fix CVE-2024-9400, users should update to the latest versions of Mozilla Thunderbird, Firefox, or Firefox ESR, specifically versions 131 or above for Thunderbird and Firefox, and 128.3 or above for Firefox ESR.
What products are affected by CVE-2024-9400?
CVE-2024-9400 affects Mozilla Thunderbird up to version 131, Firefox up to version 131, and Firefox ESR up to version 128.3.
Can CVE-2024-9400 be exploited remotely?
Yes, CVE-2024-9400 could potentially be exploited if an attacker triggers an out-of-memory (OOM) condition during the JIT compilation process.
What are the potential impacts of CVE-2024-9400?
The potential impact of CVE-2024-9400 includes memory corruption, which could allow an attacker to execute arbitrary code in the context of the affected application.