Search for vulnerabilities
Vulnerability details: VCID-39pf-czjd-1yb2
Vulnerability ID VCID-39pf-czjd-1yb2
Aliases CVE-2024-9401
Summary Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Status Published
Exploitability 0.5
Weighted Severity 8.8
Risk 4.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-9401.json
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00255 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00258 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00258 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00258 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00258 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00258 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00277 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0028 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00296 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00321 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00332 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00332 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00332 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00332 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00332 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00332 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00332 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00332 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0036 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0036 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0036 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0036 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0036 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0036 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0036 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0036 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0036 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0036 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0036 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0036 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0036 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.0036 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00473 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00473 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00473 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00473 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00473 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00473 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00473 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00473 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00473 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2024-9401
cvssv3.1 9.8 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1872744%2C1897792%2C1911317%2C1916476
ssvc Track https://bugzilla.mozilla.org/buglist.cgi?bug_id=1872744%2C1897792%2C1911317%2C1916476
cvssv3.1 8.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2024-46
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2024-47
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2024-48
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2024-49
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2024-50
cvssv3.1 9.8 https://www.mozilla.org/security/advisories/mfsa2024-46/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2024-46/
cvssv3.1 9.8 https://www.mozilla.org/security/advisories/mfsa2024-47/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2024-47/
cvssv3.1 9.8 https://www.mozilla.org/security/advisories/mfsa2024-48/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2024-48/
cvssv3.1 9.8 https://www.mozilla.org/security/advisories/mfsa2024-49/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2024-49/
cvssv3.1 9.8 https://www.mozilla.org/security/advisories/mfsa2024-50/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2024-50/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-9401.json
https://api.first.org/data/v1/epss?cve=CVE-2024-9401
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9401
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2315950 https://bugzilla.redhat.com/show_bug.cgi?id=2315950
buglist.cgi?bug_id=1872744%2C1897792%2C1911317%2C1916476 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1872744%2C1897792%2C1911317%2C1916476
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
CVE-2024-9401 https://nvd.nist.gov/vuln/detail/CVE-2024-9401
GLSA-202412-04 https://security.gentoo.org/glsa/202412-04
GLSA-202412-06 https://security.gentoo.org/glsa/202412-06
GLSA-202505-08 https://security.gentoo.org/glsa/202505-08
mfsa2024-46 https://www.mozilla.org/en-US/security/advisories/mfsa2024-46
mfsa2024-46 https://www.mozilla.org/security/advisories/mfsa2024-46/
mfsa2024-47 https://www.mozilla.org/en-US/security/advisories/mfsa2024-47
mfsa2024-47 https://www.mozilla.org/security/advisories/mfsa2024-47/
mfsa2024-48 https://www.mozilla.org/en-US/security/advisories/mfsa2024-48
mfsa2024-48 https://www.mozilla.org/security/advisories/mfsa2024-48/
mfsa2024-49 https://www.mozilla.org/en-US/security/advisories/mfsa2024-49
mfsa2024-49 https://www.mozilla.org/security/advisories/mfsa2024-49/
mfsa2024-50 https://www.mozilla.org/en-US/security/advisories/mfsa2024-50
mfsa2024-50 https://www.mozilla.org/security/advisories/mfsa2024-50/
RHSA-2024:7505 https://access.redhat.com/errata/RHSA-2024:7505
RHSA-2024:7552 https://access.redhat.com/errata/RHSA-2024:7552
RHSA-2024:7621 https://access.redhat.com/errata/RHSA-2024:7621
RHSA-2024:7622 https://access.redhat.com/errata/RHSA-2024:7622
RHSA-2024:7646 https://access.redhat.com/errata/RHSA-2024:7646
RHSA-2024:7699 https://access.redhat.com/errata/RHSA-2024:7699
RHSA-2024:7700 https://access.redhat.com/errata/RHSA-2024:7700
RHSA-2024:7702 https://access.redhat.com/errata/RHSA-2024:7702
RHSA-2024:7703 https://access.redhat.com/errata/RHSA-2024:7703
RHSA-2024:7704 https://access.redhat.com/errata/RHSA-2024:7704
RHSA-2024:7842 https://access.redhat.com/errata/RHSA-2024:7842
RHSA-2024:7853 https://access.redhat.com/errata/RHSA-2024:7853
RHSA-2024:7854 https://access.redhat.com/errata/RHSA-2024:7854
RHSA-2024:7855 https://access.redhat.com/errata/RHSA-2024:7855
RHSA-2024:7856 https://access.redhat.com/errata/RHSA-2024:7856
RHSA-2024:8166 https://access.redhat.com/errata/RHSA-2024:8166
RHSA-2024:8169 https://access.redhat.com/errata/RHSA-2024:8169
USN-7056-1 https://usn.ubuntu.com/7056-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-9401.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.mozilla.org/buglist.cgi?bug_id=1872744%2C1897792%2C1911317%2C1916476
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-01T18:07:26Z/ Found at https://bugzilla.mozilla.org/buglist.cgi?bug_id=1872744%2C1897792%2C1911317%2C1916476
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2024-46/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-01T18:20:31Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-46/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2024-47/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-01T18:20:31Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-47/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2024-48/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-01T18:20:31Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-48/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2024-49/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-01T18:20:31Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-49/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2024-50/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-01T18:20:31Z/ Found at https://www.mozilla.org/security/advisories/mfsa2024-50/
Exploit Prediction Scoring System (EPSS)
Percentile 0.11214
EPSS Score 0.00044
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
2024-10-01T15:39:01.697042+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2024/mfsa2024-48.yml 34.0.1