PT-2024-15933 · Mozilla · Firefox For Ios

Lohith Gowda M · Published 2024-02-05 · Updated 2024-10-27 · CVE-2024-0953

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 129

Description When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code. This may surprise the user and potentially direct them to unwanted content.

Recommendations For Firefox for iOS versions prior to 129, update to version 129 or later to resolve the issue. As a temporary workaround, consider disabling the QR Code Scanner feature until a patch is available. Restrict access to the QR Code Scanner to minimize the risk of exploitation. Avoid using the QR Code Scanner feature in the affected Firefox for iOS app until the issue is resolved.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-0953

Affected Products

Firefox For Ios

References · 7

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1837916 · Exploit
• https://mozilla.org/security/advisories/mfsa2024-36 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0953 · Security Note
• https://twitter.com/VulmonFeeds/status/1754590134530363417 · Twitter Post
• https://twitter.com/CVEnew/status/1754553964366815688 · Twitter Post
• https://twitter.com/lohigowda_in/status/1755092049895002285 · Twitter Post
• https://t.me/cvenotify/70833 · Telegram Post