CVE-2024-5702: Use After Free
Last updated 24 July 2024
Other sources
Memory corruption in the networking stack could have led to a potentially exploitable crash.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 128.3.1esr-1~deb11u1Fixed in 115.14.0esr-1~deb12u1Fixed in 128.3.1esr-1~deb12u1Fixed in 128.3.1esr-2 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:115.16.0esr-1~deb11u1Fixed in 1:115.12.0-1~deb12u1Fixed in 1:115.16.0esr-1~deb12u1Fixed in 1:128.2.0esr-1Fixed in 1:128.3.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.12 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 125 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.12 - Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 115.12 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.12 - Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 125 - Upgrade
Upgrade
Mozilla Firefox ESRto a version that resolves this vulnerability.Fixed in 115.12 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 115.12
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-5702?
CVE-2024-5702 is classified as a potentially exploitable crash due to memory corruption in the networking stack.
How do I fix CVE-2024-5702?
To fix CVE-2024-5702, upgrade to the latest version of Firefox, Firefox ESR, or Thunderbird that has patched this vulnerability.
Which versions of Mozilla products are affected by CVE-2024-5702?
CVE-2024-5702 affects Firefox versions before 125, Firefox ESR versions before 115.12, and Thunderbird versions before 115.12.
Can CVE-2024-5702 be exploited remotely?
CVE-2024-5702 has the potential to be exploited remotely, leading to a crash of the affected application.
What should I do if I can't update my software to mitigate CVE-2024-5702?
If unable to update, consider applying additional security measures such as disabling network features or using an alternative application until an update can be performed.