Recently-patched Firefox bug exploited against Tor browser users
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-9680 | Use-After-Free in Mozilla Firefox Animation Timelines Allows Code Execution Mozilla Firefox and Firefox ESR contain a use-after-free (CWE-416) in the browser's animation timelines component, which CISA describes as allowing code execution in the content process. The flaw is reachable through malicious web content: a crafted page can manipulate animation timelines so that an in-use object is freed, producing exploitable memory corruption. A successful attacker gains code execution in the content process, the sandboxed process that renders web pages, on the machine of the user who loaded the content. All users of Firefox and Firefox ESR are affected by the flaw itself. It is being actively exploited: the vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2024-10-15 with known ransomware use, and EPSS assigns it a 23.2% probability of exploitation in the next 30 days (98th percentile). Do: Apply Mozilla's patched Firefox/Firefox ESR release immediately and verify the running version via the browser's About Firefox dialog, since many installs only pick up auto-updates after a restart (per CISA's required action: apply mitigations per vendor instructions or discontinue use). Given the known ransomware use, prioritize enterprise ESR rollout and check for managed-update failures, auto-update-disabled installs, or unmanaged Firefox copies on user machines. Note that no public proof-of-concept is known, but KEV listing confirms exploitation, so patching should not wait for PoC availability. | 9.8 | 23% | KEV ransomware |
| masshundreds of millions of users (Firefox's global desktop user base of roughly 150-200M active users, plus enterprise Firefox ESR deployments) |
Full article268 words · extracted from therecord.media · click to collapse
The Tor anonymity network issued an emergency patch last week to address a recently-discovered security flaw that was being exploited against its users. The bug, tracked as CVE-2024-9680, allows attackers to execute malicious code within the browser’s content process — the environment where web content is loaded and rendered. The flaw was discovered by a researcher from the cybersecurity firm ESET and was first patched by the Mozilla Foundation in its Firefox web browser last week. According to Tor’s statement, Mozilla is aware of the flaw being actively exploited in the wild against Tor Browser users. “Using this vulnerability, an attacker could take control of Tor Browser, but probably not deanonymize you in Tails,” the statement reads. Tails is a privacy-focused operating system that runs from a USB or DVD, leaving no trace on the host computer after shutdown. It routes all internet traffic through the Tor network to ensure anonymity and comes with built-in tools like encrypted email, secure messaging and disk encryption. The CVE-2024-9680 vulnerability is described as a “use-after-free” flaw, which occurs when a program tries to access memory that has already been released or freed. Memory corruption bugs like this are often used to attack browsers, potentially giving attackers control over the service or further access to the system. The exploit requires no user interaction and can be executed over the network with low complexity. It has been assigned a CVSS score of 9.8 out of 10, indicating a critical vulnerability. To address the flaw, both Mozilla and Tor recommend that users update their browser installations to the most current versions available.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/recently-patched-firefox-bug-being-used-against-tor-browser-users