THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-3859

Assigner:mozilla (f16b083a-5664-49f3-a51e-8d479e5ed7fe)
Reserved:2024-04-15
Published:2024-04-16
Updated:2024-06-21

Description

On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered by a malformed OpenType font. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

Problem types

Integer-overflow led to out-of-bounds-read in the OpenType sanitizer

Product status

Any version before 125
affected

Any version before 115.10
affected

Any version before 115.10
affected

Credits

Ronald Crane

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1874489

https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html

https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html

https://www.mozilla.org/security/advisories/mfsa2024-18/

https://www.mozilla.org/security/advisories/mfsa2024-19/

https://www.mozilla.org/security/advisories/mfsa2024-20/

cve.org CVE-2024-3859

nvd.nist.gov CVE-2024-3859

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-3859