Analysis Summary

CVE-2024-8900 CVSS:6.5

Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by an error during a certain sequence of navigational events. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass the user prompt and write data to the user's clipboard.

CVE-2024-8897 CVSS:6.5

Mozilla Firefox for Android could allow a remote attacker to conduct spoofing attacks, caused by an error after server-side redirect. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the address bar contents.

CVE-2024-8394 CVSS:6.5

Mozilla Thunderbird is vulnerable to a denial of service, caused by a use-after-free when aborting the verification of an OTR chat session. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to cause the browser to crash.

Impact

• Security Bypass
• Gain Access
• Denial of Service

Indicators of Compromise

CVE

• CVE-2024-8900
• CVE-2024-8897
• CVE-2024-8394

Affected Vendors

Affected Products

• Mozilla Firefox - 128.0
• Mozilla Firefox for Android - 130.00
• Mozilla Thunderbird - 128.1

Remediation

Refer to Mozilla Foundation Security Advisory for patch, upgrade or suggested workaround information.

CVE-2024-8900

CVE-2024-8897

CVE-2024-8394