Critical · published October 9, 2024
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 97.8th percentile for exploit probability.
🚨 A sneaky use-after-free in Firefox and Thunderbird is letting attackers execute code like a magician pulling rabbits from a hat — and it’s already being exploited in the wild! 🔥 Think of it like a restaurant where a waiter forgets to clear a table. While they’re setting it up for new diners, the previous customers can still sneak in and grab leftovers from the table—they shouldn’t be there, but the door’s wide open! If exploited, attackers could gain total control over your browser or email client, opening the door to data theft, malware deployment, or even complete system takeover. This is absolutely devastating and could lead to widespread compromise if not addressed swiftly!
Think of it like a restaurant where a waiter forgets to clear a table. While they’re setting it up for new diners, the previous customers can still sneak in and grab leftovers from the table—they shouldn’t be there, but the door’s wide open! This vulnerability arises from a use-after-free error in animation timelines, allowing malicious actors to execute arbitrary code in the affected content processes of Firefox and Thunderbird.
If exploited, attackers could gain total control over your browser or email client, opening the door to data theft, malware deployment, or even complete system takeover. This is absolutely devastating and could lead to widespread compromise if not addressed swiftly! Update Firefox to version 131.0.2 or later, and Thunderbird to version 131.0.1 or later. For those using Extended Support Releases (ESR), ensure you’re on Firefox ESR 128.3.1 or later and Thunderbird ESR 128.3.1 or later. Don’t delay—patch ASAP! You’ve got this! Follow these steps, and you’ll lock down your systems in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mozilla/firefox | < 115.16.1 | 115.16.1 |
| mozilla/firefox | < 131.0.2 | 131.0.2 |
| mozilla/firefox | ≥ 128.1.0, < 128.3.1 | 128.3.1 |
| mozilla/thunderbird | < 115.16.0 | 115.16.0 |
| mozilla/thunderbird | ≥ 128.0.1, < 128.3.1 | 128.3.1 |
| mozilla/thunderbird | all versions | — |
| debian/debian_linux | all versions | — |