PT-2024-4477 · Mozilla+1 · Firefox For Ios+1

Adam Berry · Published 2024-06-13 · Updated 2024-10-30 · CVE-2024-38312

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 127

Description The issue is related to errors in presenting information to the user interface, potentially allowing a remote attacker to conduct a spoofing attack by replacing the URL in the location string. When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly within the sandboxed app bundle after app termination.

Recommendations For Firefox for iOS versions prior to 127, update to version 127 or later to resolve the issue. As a temporary workaround, consider restricting the use of private tabs until a patch is available. Avoid using the private browsing feature in affected versions to minimize the risk of data persistence.

Fix

Information Disclosure

UI Misrepresentation of Critical Information

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-451

CWE-922

Related Identifiers

BDU:2024-04979

CVE-2024-38312

Affected Products

Astra Linux

Firefox For Ios

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-38312 · Security Note
• https://bdu.fstec.ru/vul/2024-04979 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38312 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2024-27 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1878578 · Note
• https://twitter.com/CVEnew/status/1801347522390331488 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2024061403 · Note