Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-3839 State: PUBLISHED Published: 2024-04-17T07:46:11.210Z Last Updated: 2025-02-13T17:53:07.390Z Vendors: Google Products: Chrome Problem Types: Out of bounds read Description: Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html - https://issues.chromium.org/issues/41491859 - https://lists.fedoraproject.org/archives/list/package-announ
top_16.html - https://issues.chromium.org/issues/41491859 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PCWPUBGTBNT4EW32YNZMRIPB3Y4R6XL6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEP5NJUWMDRLDQUKU4LFDUHF5PCYAPIO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4PCXKCOVBUUU6GOSN46DCPI4HMER3PJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDLUD644WEWGOFKMZWC2K
/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDLUD644WEWGOFKMZWC2K7Z4CQOKQYR7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOC3HLIZCGMIJLJ6LME5UWUUIFLXEGRN/
CVE ID: CVE-2024-3840 State: PUBLISHED Published: 2024-04-17T07:46:11.396Z Last Updated: 2025-02-13T17:53:08.198Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html - https://issues.chromium.org/issues/41493458 - https://lists.fedoraproject.org/archives/list/package-a
-desktop_16.html - https://issues.chromium.org/issues/41493458 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PCWPUBGTBNT4EW32YNZMRIPB3Y4R6XL6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEP5NJUWMDRLDQUKU4LFDUHF5PCYAPIO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4PCXKCOVBUUU6GOSN46DCPI4HMER3PJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDLUD644WEWGOFKM
ER3PJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDLUD644WEWGOFKMZWC2K7Z4CQOKQYR7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOC3HLIZCGMIJLJ6LME5UWUUIFLXEGRN/
CVE ID: CVE-2024-3841 State: PUBLISHED Published: 2024-04-17T07:46:11.591Z Last Updated: 2025-02-13T17:53:08.771Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to inject scripts or HTML into a privileged page via a malicious file. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html - https://issues.chromium.org/issues/330376742 - https://lists.fedoraproject.org/archives/list/
date-for-desktop_16.html - https://issues.chromium.org/issues/330376742 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PCWPUBGTBNT4EW32YNZMRIPB3Y4R6XL6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEP5NJUWMDRLDQUKU4LFDUHF5PCYAPIO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4PCXKCOVBUUU6GOSN46DCPI4HMER3PJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDLUD64
46DCPI4HMER3PJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDLUD644WEWGOFKMZWC2K7Z4CQOKQYR7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOC3HLIZCGMIJLJ6LME5UWUUIFLXEGRN/
CVE ID: CVE-2024-3843 State: PUBLISHED Published: 2024-04-17T07:46:11.777Z Last Updated: 2025-02-13T17:53:09.442Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html - https://issues.chromium.org/issues/41486690 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorapr
ps://issues.chromium.org/issues/41486690 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PCWPUBGTBNT4EW32YNZMRIPB3Y4R6XL6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEP5NJUWMDRLDQUKU4LFDUHF5PCYAPIO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4PCXKCOVBUUU6GOSN46DCPI4HMER3PJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDLUD644WEWGOFKMZWC2K7Z4CQOKQYR7/ - ht
.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDLUD644WEWGOFKMZWC2K7Z4CQOKQYR7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOC3HLIZCGMIJLJ6LME5UWUUIFLXEGRN/
CVE ID: CVE-2024-3844 State: PUBLISHED Published: 2024-04-17T07:46:11.963Z Last Updated: 2025-02-13T17:53:10.049Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Extensions in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html - https://issues.chromium.org/issues/40058873 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fed
- https://issues.chromium.org/issues/40058873 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PCWPUBGTBNT4EW32YNZMRIPB3Y4R6XL6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEP5NJUWMDRLDQUKU4LFDUHF5PCYAPIO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4PCXKCOVBUUU6GOSN46DCPI4HMER3PJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDLUD644WEWGOFKMZWC2K7Z4CQOKQYR7/
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDLUD644WEWGOFKMZWC2K7Z4CQOKQYR7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOC3HLIZCGMIJLJ6LME5UWUUIFLXEGRN/
CVE ID: CVE-2024-3845 State: PUBLISHED Published: 2024-04-17T07:46:12.166Z Last Updated: 2025-02-13T17:53:10.600Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass mixed content policy via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html - https://issues.chromium.org/issues/323583084 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fed
https://issues.chromium.org/issues/323583084 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PCWPUBGTBNT4EW32YNZMRIPB3Y4R6XL6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEP5NJUWMDRLDQUKU4LFDUHF5PCYAPIO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4PCXKCOVBUUU6GOSN46DCPI4HMER3PJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDLUD644WEWGOFKMZWC2K7Z4CQOKQYR7/
CVE ID: CVE-2024-3846 State: PUBLISHED Published: 2024-04-17T07:46:12.358Z Last Updated: 2025-02-13T17:53:11.174Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Prompts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html - https://issues.chromium.org/issues/40064754 - https://lists.fedoraproject
04/stable-channel-update-for-desktop_16.html - https://issues.chromium.org/issues/40064754 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PCWPUBGTBNT4EW32YNZMRIPB3Y4R6XL6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEP5NJUWMDRLDQUKU4LFDUHF5PCYAPIO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4PCXKCOVBUUU6GOSN46DCPI4HMER3PJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.
/M4PCXKCOVBUUU6GOSN46DCPI4HMER3PJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDLUD644WEWGOFKMZWC2K7Z4CQOKQYR7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOC3HLIZCGMIJLJ6LME5UWUUIFLXEGRN/
CVE ID: CVE-2024-3847 State: PUBLISHED Published: 2024-04-17T07:46:12.529Z Last Updated: 2025-02-13T17:53:11.766Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html - https://issues.chromium.org/issues/328690293 - https://lists.fedoraproject.org/archives/list/package-announce@lis
html - https://issues.chromium.org/issues/328690293 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWIVXXSVO5VB3NAZVFJ7CWVBN6W2735T/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PCWPUBGTBNT4EW32YNZMRIPB3Y4R6XL6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WEP5NJUWMDRLDQUKU4LFDUHF5PCYAPIO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4PCXKCOVBUUU6GOSN46DCPI4HMER3PJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDLUD644WEWGOFKMZWC2K7Z4CQO
tps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDLUD644WEWGOFKMZWC2K7Z4CQOKQYR7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOC3HLIZCGMIJLJ6LME5UWUUIFLXEGRN/
CVE ID: CVE-2024-3848 State: PUBLISHED Published: 2024-05-16T09:03:47.178Z Last Updated: 2024-08-01T20:26:57.075Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-29 Description: A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '#' character can be used to insert a path into the fragment, effectively skipping validation. This allows an attacker to construct a URL that, when processed, ignores the protocol scheme and uses the provided path for
allows an attacker to construct a URL that, when processed, ignores the protocol scheme and uses the provided path for filesystem access. As a result, an attacker can read arbitrary files, including sensitive information such as SSH and cloud keys, by exploiting the way the application converts the URL into a filesystem path. The issue stems from insufficient validation of the fragment portion of the URL, leading to arbitrary file read through path traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/8d5aadaa-522f-4839-b41b-d7da362dd610 - https://github.com/mlflow/mlflow/commit/f8d51e21523238280ebcfdb378612afd7844eca
s/8d5aadaa-522f-4839-b41b-d7da362dd610 - https://github.com/mlflow/mlflow/commit/f8d51e21523238280ebcfdb378612afd7844eca8
CVE ID: CVE-2024-3849 State: PUBLISHED Published: 2024-05-02T16:52:54.634Z Last Updated: 2024-08-01T20:26:56.921Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: holithemes Products: Click to Chat – HoliThemes Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The Click to Chat – HoliThemes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.35. This makes it possible for authenticated attackers, with contributor access or above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in tho
tor access or above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fe25bfef-34f0-4d57-9cba-9dcbf58281c6?source=cve - https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/tools/woo/class-ht-ctc-woo.php#L284 - https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.
/new/tools/woo/class-ht-ctc-woo.php#L284 - https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/admin/admin_demo/class-ht-ctc-admin-demo.php#L280 - https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/inc/chat/class-ht-ctc-chat-shortcode.php#L207 - https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/inc/chat/class-ht-ctc-chat.php#L291 - https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/inc/group/class-ht-ctc-group-shortcode.php#L160 - https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/inc/group/class-ht-ctc-group.php#L118 - https://p
ns.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/inc/group/class-ht-ctc-group.php#L118 - https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/inc/share/class-ht-ctc-share-shortcode.php#L181 - https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/new/inc/share/class-ht-ctc-share.php#L135 - https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/prev/inc/class-ccw-shortcode.php#L277 - https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/3.35/prev/inc/commons/styles.php#L93 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3072112%40click-
mmons/styles.php#L93 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3072112%40click-to-chat-for-whatsapp%2Ftrunk&old=3064395%40click-to-chat-for-whatsapp%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3850 State: PUBLISHED Published: 2024-06-10T16:46:42.766Z Last Updated: 2024-08-26T22:44:36.830Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Uniview Products: NVR301-04S2-P4 Problem Types: CWE-79 Description: Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is limited. Also, even if JavaScript is executed, no additional benefits are obtained. Additional Analyst Notes: - CISA ADP Vulnrichment: - C
n if JavaScript is executed, no additional benefits are obtained. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-156-01
CVE ID: CVE-2024-3851 State: PUBLISHED Published: 2024-05-16T09:03:44.053Z Last Updated: 2024-08-01T20:26:56.909Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: imartinez Products: imartinez/privategpt Problem Types: CWE-79 Description: A stored Cross-Site Scripting (XSS) vulnerability exists in the 'imartinez/privategpt' repository due to improper validation of file uploads. Attackers can exploit this vulnerability by uploading malicious HTML files, such as those containing JavaScript payloads, which are then executed in the context of the victim's session when accessed. This could lead to the execution of arbitrary JavaScript code in the context of the us
e victim's session when accessed. This could lead to the execution of arbitrary JavaScript code in the context of the user's browser session, potentially resulting in phishing attacks or other malicious actions. The vulnerability affects the latest version of the repository. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/cae1a492-4e09-4d56-8e11-17703bdfe653
CVE ID: CVE-2024-3852 State: PUBLISHED Published: 2024-04-16T15:14:05.240Z Last Updated: 2024-08-01T20:26:56.409Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: GetBoundName in the JIT returned the wrong object Description: GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1883542 - https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html - https://lists.debian.org/debian-lts-announce/2024
- https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html - https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html - https://www.mozilla.org/security/advisories/mfsa2024-18/ - https://www.mozilla.org/security/advisories/mfsa2024-19/ - https://www.mozilla.org/security/advisories/mfsa2024-20/
CVE ID: CVE-2024-3853 State: PUBLISHED Published: 2024-04-16T15:14:05.547Z Last Updated: 2024-10-28T20:47:22.135Z Vendors: Mozilla Products: Firefox Problem Types: Use-after-free if garbage collection runs during realm initialization Description: A use-after-free could result if a JavaScript realm was in the process of being initialized when a garbage collection started. This vulnerability affects Firefox < 125. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1884427 - https://www.mozilla.org/security/advisories/mfsa2024-18/
CVE ID: CVE-2024-3854 State: PUBLISHED Published: 2024-04-16T15:14:05.902Z Last Updated: 2024-08-01T20:26:57.045Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Out-of-bounds-read after mis-optimized switch statement Description: In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1884552 - https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html - https://lists.debian.o
rg/show_bug.cgi?id=1884552 - https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html - https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html - https://www.mozilla.org/security/advisories/mfsa2024-18/ - https://www.mozilla.org/security/advisories/mfsa2024-19/ - https://www.mozilla.org/security/advisories/mfsa2024-20/
CVE ID: CVE-2024-3855 State: PUBLISHED Published: 2024-04-16T15:14:06.282Z Last Updated: 2024-11-12T18:09:10.060Z Vendors: Mozilla Products: Firefox Problem Types: Incorrect JIT optimization of MSubstr leads to out-of-bounds reads Description: In certain cases the JIT incorrectly optimized MSubstr operations, which led to out-of-bounds reads. This vulnerability affects Firefox < 125. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1885828 - https://www.mozilla.org/security/advisories/mfsa2024-18/
CVE ID: CVE-2024-3856 State: PUBLISHED Published: 2024-04-16T15:14:06.623Z Last Updated: 2024-08-12T20:42:59.832Z Vendors: Mozilla Products: Firefox Problem Types: Use-after-free in WASM garbage collection Description: A use-after-free could occur during WASM execution if garbage collection ran during the creation of an array. This vulnerability affects Firefox < 125. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1885829 - https://www.mozilla.org/security/advisories/mfsa2024-18/
CVE ID: CVE-2024-3857 State: PUBLISHED Published: 2024-04-16T15:14:06.935Z Last Updated: 2024-08-01T20:26:56.991Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Incorrect JITting of arguments led to use-after-free during garbage collection Description: The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garbage collection. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1886683 - https://lists.debian.org/debian-lts-announce/202