PT-2024-9178 · Mozilla · Firefox For Ios

Bharat Adhikari · Published 2024-11-25 · Updated 2024-11-27 · CVE-2024-53976

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Firefox for iOS versions prior to 133

Description: The issue arises under certain circumstances when navigating to a webpage, resulting in the address missing from the location URL bar. This makes it unclear what the URL is for the loaded webpage. The vulnerability may allow a remote attacker to conduct spoofing attacks due to incorrect restriction of visualized user interface layers.

Recommendations: For Firefox for iOS versions prior to 133, update to version 133 or later to resolve the issue. As a temporary workaround, consider being cautious when navigating to webpages where the URL is not visible in the address bar, and verify the authenticity of the webpage through other means if possible.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

BDU:2024-10865

CVE-2024-53976

Affected Products

Firefox For Ios

References · 12

• https://mozilla.org/security/advisories/mfsa2024-66 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53976 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-53976 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53976 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10865 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-53976 · Security Note
• https://ubuntu.com/security/CVE-2024-53976 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1861833062255866162 · Twitter Post
• https://vuldb.com/?id.286175 · Note
• https://reddit.com/r/k12cybersecurity/comments/1h1a8gv/msisac_cybersecurity_advisory_multiple · Reddit Post
• https://twitter.com/CVEnew/status/1861407295160099026 · Twitter Post
• https://bugzilla.mozilla.org/show_bug.cgi?id=1905749 · Note