CVE-2024-9680
CVE-2024-9680
In short
A flaw in how Firefox handles animation timelines allows attackers to run malicious code on your computer. This happens when the browser tries to use animation data that has already been deleted from memory, and criminals are actively exploiting it.
Technical detail
Use-after-free vulnerability in the animation timeline subsystem enables arbitrary code execution within the content process. The attack requires no user interaction beyond visiting a malicious webpage; successful exploitation compromises process isolation and grants attacker code execution with content process privileges. Active exploitation in the wild has been confirmed.
Summary generated and translated by AI from the official description.
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
public PoCs found — 2
githubgithub.com/tdonaworth/Firefox-CVE-2024-9680★ 11githubgithub.com/moscovium-mc/Tor-0day-JavaScript-Exploit★ 10⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992https://bugzilla.mozilla.org/show_bug.cgi?id=1923344https://lists.debian.org/debian-lts-announce/2024/10/msg00005.htmlhttps://lists.debian.org/debian-lts-announce/2024/10/msg00006.htmlhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680https://www.mozilla.org/security/advisories/mfsa2024-51/https://www.mozilla.org/security/advisories/mfsa2024-52/