Linux · Security advisory · March 25, 2024
RHSA-2024:1485: Security update for 2 packages
RHSA-2024:1485, released March 25, 2024, fixes 10 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
10
8 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0470
91st percentile
Priority of the 10 CVEs
Patch now 0
Urgent 8
High 1
Routine 1
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| firefox | RHEL 9 | 0:115.9.1-1.el9_3 |
| firefox-x11 | RHEL 9 | 0:115.9.1-1.el9_3 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2024-29944 | Mozilla Firefox ESR and 3 others: Inclusion of Web Functionality from an Untrusted Source | 8.8 | 0.0470 | None reported | |
| Urgent | CVE-2024-0743 | Mozilla Firefox ESR and 5 others: Unchecked Return Value | 7.5 | 0.0129 | None reported | |
| Urgent | CVE-2024-2607 | Mozilla Firefox ESR and 5 others: Write-what-where Condition | 8.1 | 0.0111 | None reported | |
| Urgent | CVE-2024-2612 | Mozilla Firefox ESR and 5 others: Use After Free | 8.1 | 0.0097 | None reported | |
| Urgent | CVE-2024-2614 | Mozilla Firefox ESR and 5 others: Out-of-bounds Write | 8.8 | 0.0089 | None reported | |
| Urgent | CVE-2024-2610 | Mozilla Firefox ESR and 5 others: Improper Control of Generation of Code ('Code Injection') | 6.1 | 0.0070 | None reported | |
| Urgent | CVE-2024-2611 | Mozilla Firefox ESR and 5 others: A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into… | 6.1 | 0.0061 | None reported | |
| Urgent | CVE-2024-2608 | Mozilla Firefox ESR and 5 others: Integer Overflow to Buffer Overflow | 8.4 | 0.0039 | None reported | |
| High | CVE-2024-2616 | Mozilla Firefox ESR and 5 others: To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead… | 7.5 | 0.0070 | None reported | |
| Routine | CVE-2023-5388 | Mozilla Firefox ESR and 5 others: NSS was susceptible to a timing side-channel attack when performing RSA decryption. | 6.5 | 0.0097 | None reported |
Showing 1 to 10 of 10
1