CVE-2024-2608: Integer Overflow
AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding() and AppendEncodedCharacters() could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write.
External Reference: https://www.mozilla.org/en-US/security/advisories/mfsa2024-13/#CVE-2024-2608
Other sources
AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding() and AppendEncodedCharacters() could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
— Launchpad
AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding() and AppendEncodedCharacters() could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write.
— Mozilla
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-2608?
CVE-2024-2608 has a moderate severity level due to potential integer overflows leading to out of bounds writes.
How do I fix CVE-2024-2608?
To fix CVE-2024-2608, update to Mozilla Firefox versions 124 and above, or Firefox ESR and Thunderbird versions 115.9 and above.
Which products are affected by CVE-2024-2608?
Affected products include Mozilla Firefox up to version 124, Firefox ESR up to version 115.9, and Thunderbird up to version 115.9.
What kind of vulnerability is CVE-2024-2608?
CVE-2024-2608 is an integer overflow vulnerability that can result in an output buffer underallocation.
Can CVE-2024-2608 lead to remote code execution?
CVE-2024-2608 could potentially lead to remote code execution due to the out of bounds write, making it a serious concern.