PT-2024-2389 · Mozilla+4 · Firefox+4

P1Umer · Published 2024-03-19 · Updated 2025-03-14 · CVE-2024-2606

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 124

Description The issue is related to incorrect handling of WASM register values. Exploitation of this issue could allow a remote attacker to execute arbitrary code. The problem arises when invalid data is passed, potentially leading to the creation of invalid WASM values, such as converting arbitrary integers into pointer values.

Recommendations For versions prior to 124, update to version 124 or later to resolve the issue. As a temporary workaround, consider restricting the use of WASM functionality until a patch is available.

Exploit

Fix

Incorrect Type Conversion or Cast

RCE

Weakness Enumeration

CWE-704

CWE-20

Related Identifiers

ALT-PU-2024-15839

ALT-PU-2024-4271

BDU:2024-02341

CVE-2024-2606

OESA-2025-1265

OESA-2025-1268

OPENSUSE-SU-2024:13795-1

OPENSUSE-SU-2024:14572-1

USN-6703-1

Affected Products

Alt Linux

Astra Linux

Firefox

Linuxmint

Ubuntu

References · 2091

• 🔥 https://github.com/LOURC0D3/CVE-2024-4367-PoC · Exploit
• 🔥 https://github.com/bjrjk/CVE-2024-29943 · Exploit
• 🔥 https://github.com/s4vvysec/CVE-2024-4367-POC · Exploit
• 🔥 https://github.com/spaceraccoon/detect-cve-2024-4367 · Exploit
• 🔥 https://github.com/Zombie-Kaiser/cve-2024-4367-PoC-fixed · Exploit
• 🔥 https://github.com/tdonaworth/Firefox-CVE-2024-9680 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-4367 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-9394 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-6613 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-10466 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-5725 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-9400 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-5172 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-3853 · Security Note
• https://ubuntu.com/security/CVE-2024-2606 · Vendor Advisory