PT-2024-7613 · Mozilla+5 · Thunderbird+6

Pedro Bernardo

·

Published

2024-07-09

·

Updated

2025-03-14

·

CVE-2024-6611

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 128 Thunderbird versions prior to 128
Description A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This issue is related to the incorrect SameSite attribute in a cookie file, which could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.
Recommendations For Firefox versions prior to 128, update to version 128 or later to resolve the issue. For Thunderbird versions prior to 128, update to version 128 or later to resolve the issue. As a temporary workaround, consider restricting access to iframes that could trigger cross-site navigation until a patch is available.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-1275

Related Identifiers

ALT-PU-2024-10126
ALT-PU-2024-10593
ALT-PU-2024-13895
ALT-PU-2024-13897
ALT-PU-2024-15839
ALT-PU-2024-15841
BDU:2024-09019
CVE-2024-6611
OESA-2025-1265
OESA-2025-1268
OPENSUSE-SU-2024:14197-1
OPENSUSE-SU-2024:14572-1
OPENSUSE-SU-2024_3003-1
OPENSUSE-SU-2024_3507-1
SUSE-SU-2024:2876-1
SUSE-SU-2024:3003-1
SUSE-SU-2024:3507-1
USN-6890-1

Affected Products

Alt Linux
Astra Linux
Firefox
Linuxmint
Suse
Thunderbird
Ubuntu