Vulnerability CVE-2024-29944: Information

Description

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox. This vulnerability affects Firefox < 124.0.1 and Firefox ESR < 115.9.1.

Published: March 22, 2024
Modified: March 25, 2024

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus124.0.1-alt2124.0.2-alt1ALT-PU-2024-4915-3344191Fixed
firefoxsisyphus_riscv64124.0.1-alt0.port124.0.1-alt0.portALT-PU-2024-6052-1-Fixed
firefoxsisyphus_loongarch64124.0.2-alt1.0.port124.0.2-alt1.0.portALT-PU-2024-6274-1-Fixed
firefox-esrsisyphus115.9.1-alt1115.10.0-alt1ALT-PU-2024-4963-2344244Fixed
firefox-esrsisyphus_loongarch64115.9.1-alt1115.10.0-alt1ALT-PU-2024-5937-1-Fixed
firefox-esrp10115.9.1-alt1115.9.1-alt1ALT-PU-2024-4971-3344254Fixed
firefox-esrc10f1115.9.1-alt0.c10.1115.9.1-alt0.c10.1ALT-PU-2024-6027-2344289Fixed

References to Advisories, Solutions, and Tools