CVE-2024-5702

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 125
Mozilla	Firefox ESR	>= unspecified, < 115.12
Mozilla	Thunderbird	>= unspecified, < 115.12
mozilla	firefox	< 125
mozilla	firefox_esr	< 115.12
mozilla	thunderbird	< 115.12

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1193389Issue Tracking
https://lists.debian.org/debian-lts-announce/2024/06/msg00000.htmlMailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00010.htmlMailing List
https://www.mozilla.org/security/advisories/mfsa2024-18/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-26/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-28/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1193389Issue Tracking
https://lists.debian.org/debian-lts-announce/2024/06/msg00000.htmlMailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00010.htmlMailing List
https://www.mozilla.org/security/advisories/mfsa2024-18/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-26/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-28/Vendor Advisory

Timeline

Published: Jun 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-570208.8TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sMinute" parameter in setWi CVE-2024-570218.8TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eHour" parameter in setWiFi CVE-2024-570228.8TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sHour" parameter in setWiFi CVE-2024-570236.8TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setWiFiS CVE-2024-570246.8TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eMinute" parameter in setWi CVE-2024-570256.8TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setWiFiS CVE-2024-570266.1TawkTo Widget Version <= 1.3.7 is vulnerable to Cross Site Scripting (XSS) due to processing user input in a way that allows JavaScript exec CVE-2024-57034.3The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln CVE-2024-570308.1Wegia < 3.2.0 is vulnerable to Cross Site Scripting (XSS) in /geral/documentos_funcionario.php via the id parameter.CVE-2024-570319.8WeGIA < 3.2.0 is vulnerable to SQL Injection in /funcionario/remuneracao.php via the id_funcionario parameter.CVE-2024-570329.8WeGIA < 3.2.0 is vulnerable to Incorrect Access Control in controle/control.php. The application does not validate the value of the old pass CVE-2024-570336.1WeGIA < 3.2.0 is vulnerable to Cross Site Scripting (XSS) via the dados_addInfo parameter of documentos_funcionario.php.