CVE-2024-29944

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-29944
An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox. This vulnerability affects Firefox < 124.0.1 and Firefox ESR < 115.9.1.
CVSS

No CVSS.

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/03/23/1 Mailing List
http://www.openwall.com/lists/oss-security/2024/03/23/1 Mailing List
https://bugzilla.mozilla.org/show_bug.cgi?id=1886852 Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=1886852 Issue Tracking
https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html Mailing List
https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html Mailing List
https://www.mozilla.org/security/advisories/mfsa2024-15/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-15/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-16/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-16/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

01 Apr 2025, 16:30

Type Values Removed Values Added
First Time Debian debian Linux
Mozilla firefox
Debian
Mozilla
CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
References () https://www.mozilla.org/security/advisories/mfsa2024-16/ - () https://www.mozilla.org/security/advisories/mfsa2024-16/ - Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2024/03/23/1 - () http://www.openwall.com/lists/oss-security/2024/03/23/1 - Mailing List
References () https://bugzilla.mozilla.org/show_bug.cgi?id=1886852 - () https://bugzilla.mozilla.org/show_bug.cgi?id=1886852 - Issue Tracking
References () https://www.mozilla.org/security/advisories/mfsa2024-15/ - () https://www.mozilla.org/security/advisories/mfsa2024-15/ - Vendor Advisory
References () https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html - () https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html - Mailing List

01 May 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/03/23/1 -

25 Mar 2024, 17:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html -

22 Mar 2024, 17:15

Type Values Removed Values Added
Summary An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. This vulnerability affects Firefox < 124.0.1 and Firefox ESR < 115.9.1. An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox. This vulnerability affects Firefox < 124.0.1 and Firefox ESR < 115.9.1.

22 Mar 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-22 13:15

Updated : 2025-04-01 16:30

NVD link : CVE-2024-29944

Mitre link : CVE-2024-29944

JSON object : View

Products Affected

debian

  • debian_linux

mozilla

  • firefox
CWE

No CWE.