CVE-2024-9401: Buffer Overflow

Q: What is the severity of CVE-2024-9401?

CVE-2024-9401 is classified as a critical vulnerability due to the potential for memory corruption that could lead to arbitrary code execution.

Q: How do I fix CVE-2024-9401?

To fix CVE-2024-9401, upgrade to Firefox 131, Firefox ESR 128.3, or Thunderbird 131.

Q: Which software versions are affected by CVE-2024-9401?

CVE-2024-9401 affects Firefox versions up to 130, Firefox ESR 115.15 and 128.2, and Thunderbird versions up to 128.2.

Q: What types of bugs are associated with CVE-2024-9401?

CVE-2024-9401 is associated with memory safety bugs that may lead to memory corruption.

Q: Can CVE-2024-9401 be exploited?

Yes, with sufficient effort, the memory safety bugs in CVE-2024-9401 could potentially be exploited to run arbitrary code.

Published Oct 1, 2024

Updated

Last updated 7 October 2024

Other sources

Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

— Mozilla

This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.

— Launchpad

Affected Software

19 affected componentsFixes available

Mozilla Thunderbird<131

131

Mozilla Firefox<131

131

Mozilla Firefox ESR<115.16

115.16

Mozilla Firefox ESR<128.3

128.3

Mozilla Firefox<115.16.0

Mozilla Firefox<131.0

Mozilla Firefox>=116.0<128.3.0

Mozilla Thunderbird<128.3.0

Mozilla Thunderbird>=129.0<131.0

debian/firefox-esr<128.3.0esr-1~deb12u1

128.3.0esr-1~deb12u1

debian/firefox-esr<128.3.0esr-1

128.3.0esr-1

debian/firefox-esr<128.3.0esr-1

128.3.0esr-1

debian/thunderbird<1:115.16.0esr-1~deb12u1

1:115.16.0esr-1~deb12u1

debian/thunderbird<1:128.3.0esr-1

1:128.3.0esr-1

debian/thunderbird<1:128.3.0esr-1

1:128.3.0esr-1

Mozilla Thunderbird<128.3

128.3

debian/firefox

159.0.1-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.6.0esr-1~deb12u2140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.6.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u21:140.12.0esr-1~deb13u11:153.6.0esr-1~deb13u11:153.5.0esr-11:153.6.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 131
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 131
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.16
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 128.3
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 128.3.0esr-1~deb12u1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 128.3.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.16.0esr-1~deb12u1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:128.3.0esr-1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.3
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 159.0.1-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1

Event History

Oct 1, 2024

CVE Published

via Mozilla·12:00 AM

Data Sourced

via Mozilla·12:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·03:13 PM

Data Sourced

via MITRE·03:13 PM

DescriptionWeakness

Data Sourced

via Red Hat·04:01 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·04:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-9401?

CVE-2024-9401 is classified as a critical vulnerability due to the potential for memory corruption that could lead to arbitrary code execution.

How do I fix CVE-2024-9401?

To fix CVE-2024-9401, upgrade to Firefox 131, Firefox ESR 128.3, or Thunderbird 131.

Which software versions are affected by CVE-2024-9401?

CVE-2024-9401 affects Firefox versions up to 130, Firefox ESR 115.15 and 128.2, and Thunderbird versions up to 128.2.

What types of bugs are associated with CVE-2024-9401?

CVE-2024-9401 is associated with memory safety bugs that may lead to memory corruption.

Can CVE-2024-9401 be exploited?

Yes, with sufficient effort, the memory safety bugs in CVE-2024-9401 could potentially be exploited to run arbitrary code.

CVE-2024-9401: Buffer Overflow

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-9401?

How do I fix CVE-2024-9401?

Which software versions are affected by CVE-2024-9401?

What types of bugs are associated with CVE-2024-9401?

Can CVE-2024-9401 be exploited?

Company

Resources

Contact