Oracle Linux: CVE-2024-9393: ELSA-2024-7505: firefox security update (IMPORTANT) (Multiple Advisories)

Oracle Linux: CVE-2024-9393: ELSA-2024-7505:firefox security update (IMPORTANT) (Multiple Advisories)

Severity

9

CVSS

(AV:N/AC:L/Au:N/C:P/I:C/A:P)

Published

10/01/2024

Created

10/18/2024

Added

10/16/2024

Modified

01/07/2025

Description

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin.This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131. A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the issue as follows: An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the resource://pdf.js origin. This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions.

Solution(s)

• oracle-linux-upgrade-firefox
• oracle-linux-upgrade-firefox-x11
• oracle-linux-upgrade-thunderbird

References

• https://attackerkb.com/topics/cve-2024-9393
• CVE - 2024-9393
• ELSA-2024-7505
• ELSA-2024-7700
• ELSA-2024-7699
• ELSA-2024-7552
• ELSA-2024-7702