Use-after-free in Animation timeline (128.3.1 ESR Chemspill)
CVE: CVE-2024-9680
Component: firefox
CWE: CWE-416
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-10-09T14:08:00+00:00

A remote code execution vulnerability was found in Firefox and Thunderbird. The Mozilla Foundation Security Advisories state: An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines.

Statement: The Mozilla Foundation Security Advisory indicates that this vulnerability is being exploited in the wild.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
To install and use Red Hat Enterprise Linux Flatpak content available in the the Red Hat Container Catalog, make sure that you have the latest version of the Flatpak client installed on your system:

yum update flatpak

After updating the Flatpak packages, add the Flatpak remote to your system:

flatpak remote-add rhel https://flatpaks.redhat.io/rhel.flatpakrepo

Provide the credentials for your Red Hat Enterprise Linux account:

podman login registry.redhat.io

Podman only saves credentials until the user logs out. To save your credentials permanently, run:

cp $XDG_RUNTIME_DIR/containers/auth.json $HOME/.config/flatpak/oci-auth.json

To enable the RHEL Flatpak remote for a set of workstations within an organization, you should use a Registry Service Account. Credentials can be installed system-wide at /etc/flatpak/oci-auth.json.

Then, you can install the Firefox Flatpak container image:

flatpak install rhel org.firefox.Firefox

For more information about the image, search the <image_name> in the Red Hat Ecosystem Catalog: https://catalog.redhat.com/software/containers/search.
To install and use Red Hat Enterprise Linux Flatpak content available in the the Red Hat Container Catalog, make sure that you have the latest version of the Flatpak client installed on your system:

yum update flatpak

After updating the Flatpak packages, add the Flatpak remote to your system:

flatpak remote-add rhel https://flatpaks.redhat.io/rhel.flatpakrepo

Provide the credentials for your Red Hat Enterprise Linux account:

podman login registry.redhat.io

Podman only saves credentials until the user logs out. To save your credentials permanently, run:

cp $XDG_RUNTIME_DIR/containers/auth.json $HOME/.config/flatpak/oci-auth.json

To enable the RHEL Flatpak remote for a set of workstations within an organization, you should use a Registry Service Account. Credentials can be installed system-wide at /etc/flatpak/oci-auth.json.

Then, you can install the Thunderbird Flatpak container image:

flatpak install rhel org.thunderbird.Thunderbird

For more information about the image, search the <image_name> in the Red Hat Ecosystem Catalog: https://catalog.redhat.com/software/containers/search.
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.