Actively exploited Firefox zero-day fixed, update ASAP! (CVE-2024-9680)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-9680 | Use-After-Free in Mozilla Firefox Animation Timelines Allows Code Execution Mozilla Firefox and Firefox ESR contain a use-after-free (CWE-416) in the browser's animation timelines component, which CISA describes as allowing code execution in the content process. The flaw is reachable through malicious web content: a crafted page can manipulate animation timelines so that an in-use object is freed, producing exploitable memory corruption. A successful attacker gains code execution in the content process, the sandboxed process that renders web pages, on the machine of the user who loaded the content. All users of Firefox and Firefox ESR are affected by the flaw itself. It is being actively exploited: the vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2024-10-15 with known ransomware use, and EPSS assigns it a 23.2% probability of exploitation in the next 30 days (98th percentile). Do: Apply Mozilla's patched Firefox/Firefox ESR release immediately and verify the running version via the browser's About Firefox dialog, since many installs only pick up auto-updates after a restart (per CISA's required action: apply mitigations per vendor instructions or discontinue use). Given the known ransomware use, prioritize enterprise ESR rollout and check for managed-update failures, auto-update-disabled installs, or unmanaged Firefox copies on user machines. Note that no public proof-of-concept is known, but KEV listing confirms exploitation, so patching should not wait for PoC availability. | 9.8 | 23% | KEV ransomware |
| masshundreds of millions of users (Firefox's global desktop user base of roughly 150-200M active users, plus enterprise Firefox ESR deployments) |
Full article416 words · extracted from helpnetsecurity.com · click to collapse
Mozilla has pushed out an emergency update for its Firefox and Firefox ESR browsers to fix a vulnerability (CVE-2024-9680) that is being exploited in the wild.
About CVE-2024-9680
Reported by ESET malware researcher Damien Schaeffer, CVE-2024-9680 is a use-after-free vulnerability in the browser’s Animation timelines and, according to Mozilla, has been exploited to achieve code execution in the content process.
Additional details about the vulnerability or the attacks are yet to be shared.
According to Mozilla’s engineers, the versions with the fix – Firefox 131.0.2, Firefox ESR 115.16.1 and Firefox ESR 128.3.1 – have been shipped within 25 hours after the vulnerability was reported to them.
How to upgrade your Firefox?
Automatic updates are enabled in Firefox by default, so this latest security update will be delivered to most home users and implemented when they restart their browser.
Those who have turned off the option must check for updates manually (in Settings > General > Firefox Updates), and are urged to upgrade as soon as possible.
Firefox update options
In enterprise settings, automatic updates are often disabled by the organization’s IT administrators and employees usually don’t have sufficient privileges to check for and implement updates – it’s the IT department’s responsibility to implement them.
Tor Browser, which includes a modified Mozilla Firefox ESR browser, has also been updated to fix the vulnerability.
UPDATE (October 15, 2024, 05:30 a.m. ET):
The Tor Project has released the latest version of the Tails operating system, which uses a modified version of Tor Browser.
“Using [CVE-2024-9680], an attacker could take control of Tor Browser, but probably not deanonymize you in Tails,” they noted.
The team also says that they have no evidence that Tor Browser users were targeted by attackers leveraging this flaw.
The vulnerability has been fixed in:
- Tor Browser 13.5.7 and 14.0a9
- Tor Browser for Android 13.5.8
- Tails 6.8.1
UPDATE (October 16, 2024, 05:30 a.m. ET):
CVE-2024-9680 has also been fixed in Thunderburd, Mozilla’s email client, but the potential for exploitation is low.
“In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts,” Mozilla explained.
UPDATE (November 26, 2024, 08:25 a.m. ET):
ESET researchers have explained how Russia-aligned APT group RomCom leveraged the vulnerability to target users in Europe and North America.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/10/10/cve-2024-9680/