7.0 High

CVE-2024-5700 Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11

Description

Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.

CVSS 3.1 detail

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitable with local access to the machine, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Local
Attack complexity: High
Privileges required: None
Interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
Firefox 127	earliest → < 127	127
Firefox ESR 115.12	earliest → < 115.12	115.12
Thunderbird 115.12	earliest → < 115.12	115.12
firefox_esr 115.12	earliest → < 115.12	115.12