PT-2024-32708 · Mozilla+1 · Firefox+2

Dana Keeler · Published 2024-05-14 · Updated 2024-12-27 · CVE-2024-4765

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 126 Firefox for Android versions prior to 126

Description The issue arises from the use of an insecure MD5 hash to store web application manifests, allowing for a hash collision that could overwrite another application's manifest. This could be exploited to run arbitrary code in another application's context.

Recommendations For Firefox versions prior to 126, update to version 126 or later to resolve the issue. For Firefox for Android versions prior to 126, update to version 126 or later to resolve the issue.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

ALT-PU-2024-15839

ALT-PU-2024-7772

CVE-2024-4765

OPENSUSE-SU-2024:13980-1

OPENSUSE-SU-2024:14572-1

Affected Products

Alt Linux

Firefox

Firefox For Android

References · 1868

• https://mozilla.org/security/advisories/mfsa2024-21 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4765 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13980-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-4765 · Vendor Advisory
• https://suse.com/security/cve/CVE-2023-25744 · Note
• https://suse.com/security/cve/CVE-2021-29962 · Note
• https://suse.com/security/cve/CVE-2023-29545 · Note
• https://suse.com/security/cve/CVE-2020-26955 · Note
• https://suse.com/security/cve/CVE-2015-2731 · Note
• https://suse.com/security/cve/CVE-2024-2612 · Note
• https://suse.com/security/cve/CVE-2023-5731 · Note
• https://suse.com/security/cve/CVE-2016-5281 · Note
• https://suse.com/security/cve/CVE-2019-17016 · Note
• https://suse.com/security/cve/CVE-2022-29917 · Note