In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
References
| Link | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1884552 | Issue Tracking |
| https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html | Mailing List Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html | Mailing List Third Party Advisory |
| https://www.mozilla.org/security/advisories/mfsa2024-18/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2024-19/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2024-20/ | Vendor Advisory |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1884552 | Issue Tracking |
| https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html | Mailing List Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html | Mailing List Third Party Advisory |
| https://www.mozilla.org/security/advisories/mfsa2024-18/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2024-19/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2024-20/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
01 Apr 2025, 14:11
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugzilla.mozilla.org/show_bug.cgi?id=1884552 - Issue Tracking | |
| References | () https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html - Mailing List, Third Party Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html - Mailing List, Third Party Advisory | |
| References | () https://www.mozilla.org/security/advisories/mfsa2024-18/ - Vendor Advisory | |
| References | () https://www.mozilla.org/security/advisories/mfsa2024-19/ - Vendor Advisory | |
| References | () https://www.mozilla.org/security/advisories/mfsa2024-20/ - Vendor Advisory | |
| First Time |
Mozilla firefox
Mozilla Mozilla thunderbird |
|
| CPE | cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
Information
Published : 2024-04-16 16:15
Updated : 2025-04-01 14:11
NVD link : CVE-2024-3854
Mitre link : CVE-2024-3854
CVE.ORG link : CVE-2024-3854
JSON object : View
Products Affected
mozilla
- thunderbird
- firefox
CWE
CWE-125
Out-of-bounds Read