CVE-2024-7524

Published: 6 August 2024

Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a site protected by Content Security Policy in "strict-dynamic" mode, an attacker able to inject an HTML element could have used a DOM Clobbering attack on some of the shims and achieved XSS, bypassing the CSP strict-dynamic protection. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1.

Notes

mozjs* contain a copy of the SpiderMonkey JavaScript engine. It
is not feasible to backport security fixes to the mozjs*
packages, as such, marking them as ignored.
starting with Ubuntu 22.04, the firefox package is just a script
that installs the Firefox snap
starting with Ubuntu 24.04, the thunderbird package is just a
script that installs the Thunderbird snap

Status

Severity score breakdown

References

• https://www.cve.org/CVERecord?id=CVE-2024-7524
• https://www.mozilla.org/en-US/security/advisories/mfsa2024-33/#CVE-2024-7524
• https://www.mozilla.org/en-US/security/advisories/mfsa2024-34/#CVE-2024-7524
• https://bugzilla.mozilla.org/show_bug.cgi?id=1909241
• https://www.mozilla.org/security/advisories/mfsa2024-33/
• https://www.mozilla.org/security/advisories/mfsa2024-34/
• https://www.mozilla.org/security/advisories/mfsa2024-35/
• https://ubuntu.com/security/notices/USN-6966-1
• NVD
• Launchpad
• Debian