Seems bad. "An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild."<p>See:<p>- NVD page for CVE-2024-9680: <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-9680" rel="nofollow">https://nvd.nist.gov/vuln/detail/CVE-2024-9680</a><p>- Mozilla security advisory: <a href="https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/" rel="nofollow">https://www.mozilla.org/en-US/security/advisories/mfsa2024-5...</a>
The patch: <a href="https://hg.mozilla.org/releases/mozilla-release/rev/d2a21d941ed5a73a37b3446caa4a49e74ffe854b" rel="nofollow">https://hg.mozilla.org/releases/mozilla-release/rev/d2a21d94...</a>
A note for Ubuntu users; if Firefox is installed using `snap` (default) and you run `snap refresh` it will output "All snaps up to date" - but this is not true!
You have to close firefox, then run `snap refresh` for snap to upgrade firefox...
Redhat bugzilla has a tiny bit more info about dates (looks like very recent?) and is public:<p><a href="https://bugzilla.redhat.com/show_activity.cgi?id=2317442" rel="nofollow">https://bugzilla.redhat.com/show_activity.cgi?id=2317442</a><p>and likely affects Thunderbird as well by the looks of things.
> The vulnerability impacts the latest Firefox (standard release) and the extended support releases (ESR).<p>Does that mean it impacts Firefox 131.0.+, Firefox ESR 115.16.+ and Firefox ESR 128.3.+?<p>I.e. Firefox 130.0.+ or Firefox ESR 114.+.+ are fine? It's not clear to me when the vulnerability was introduced...
We need a browser written in managed lang<p>Even if it means some perf drop, modern hardware will get it back in X years, but safety will be significantly improved
This seems quite bad, but how practical is it.<p>Like, the attacker will get write and read access to part or the whole of some other object allocated on the heap, when the memory is reused?<p>Seems hard to do anything useful with.
I wonder how many skilled black hats work for Iran, China or Russia.<p>And I can imagine that those countries use front companies to buy exploit.<p>I just hope that those blackhats understand that their discovery might land in the wrong hands.<p>I guess those blackhats don't like authoritarian regimes.
this is the change that fixed it<p><a href="https://github.com/mozilla/gecko-dev/commit/7a85a111b5f42cdc07f438e36f9597c4c6dc1d48">https://github.com/mozilla/gecko-dev/commit/7a85a111b5f42cdc...</a>