PT-2024-2357 · Mozilla+4 · Firefox+4
Manfred Paul
·
Published
2024-03-22
·
Updated
2026-01-29
·
CVE-2024-29943
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 124.0.1
Description
The issue is related to an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. This can allow an attacker to read outside the expected values or execute arbitrary code remotely. The vulnerability is associated with the SpiderMonkey JIT Compiler.
Recommendations
For Firefox versions prior to 124.0.1, update to version 124.0.1 or later to resolve the issue. As a temporary workaround, consider disabling the JavaScript engine or restricting its use until a patch is available. Avoid using the
MObjectKeysLength::computeRange function in the IonMonkey until the issue is resolved. Restrict access to the SpiderMonkey JIT Compiler to minimize the risk of exploitation.Exploit
Fix
Out of bounds Read
Memory Corruption
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Firefox
Linuxmint
Ubuntu