CVE-2024-7526

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

A

NGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1910306	Issue Tracking Permissions Required
https://www.mozilla.org/security/advisories/mfsa2024-33/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-34/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-35/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-37/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-38/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox_esr::::::::
	cpe:2.3:a:mozilla:firefox_esr:128.0:::::::*
	cpe:2.3:a:mozilla:thunderbird::::::::
	cpe:2.3:a:mozilla:thunderbird:128.0.1:::::::*

History

17 Sep 2024, 19:15

Type	Values Removed	Values Added
Summary	(en) ANGLE failed to initialize parameters which led to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.	(en) ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

12 Aug 2024, 16:07

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-06 13:15

Updated : 2024-09-17 19:15

NVD link : CVE-2024-7526

Mitre link : CVE-2024-7526

CVE.ORG link : CVE-2024-7526

JSON object : View

Products Affected

CWE

CWE-908

Use of Uninitialized Resource

{"id": "CVE-2024-7526", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-08-06T13:15:57.483", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1910306", "tags": ["Issue Tracking", "Permissions Required"], "source": "[email protected]"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-33/", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-34/", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-35/", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-37/", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-38/", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-908"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-908"}]}], "descriptions": [{"lang": "en", "value": "ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14."}, {"lang": "es", "value": "ANGLE no pudo inicializar los par\u00e1metros, lo que provoc\u00f3 la lectura desde la memoria no inicializada. Esto podr\u00eda aprovecharse para filtrar datos confidenciales de la memoria. Esta vulnerabilidad afecta a Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1 y Thunderbird < 115.14."}], "lastModified": "2024-09-17T19:15:28.857", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12C9ABF7-3B44-4C24-B152-488DCF9E2D39", "versionEndExcluding": "129.0"}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95A2A856-7C7A-46A3-A2B5-967E63D7083A", "versionEndExcluding": "115.14.0"}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:128.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE7D7BC3-F9A8-42D3-8C60-464457B7B2CC"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86167092-2071-4D6B-8CBC-F5C13923D7A8", "versionEndExcluding": "115.14.0"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:128.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65FE0D69-95D3-4440-8DE5-141510B64C20"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}