CVE-2024-1546

Published: Feb 20, 2024Modified: Mar 27, 2025

7.5

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.

Affected (4)

Products: Mozilla: Firefox, Thunderbird · Debian: Debian Linux

2 products

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Before 123.0
Mozilla Firefox	Before 115.8.0
Mozilla Thunderbird	Before 115.8.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (12)

https://bugzilla.mozilla.org/show_bug.cgi?id=1843752

Source: security@mozilla.org

Issue Tracking

https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html

Source: security@mozilla.org

Mailing List

https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html

Source: security@mozilla.org

Mailing List

https://www.mozilla.org/security/advisories/mfsa2024-05/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2024-06/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2024-07/

Source: security@mozilla.org

Vendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=1843752