CVE-2024-8383
Description
Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems don't have a trusted newsreader installed by default, an unscrupulous program that the user downloaded could register itself as a handler. The website that served the application download could then launch that application at will. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Firefox ESR < 115.15.
How to fix
- mozilla firefox130.0 or later
- mozilla firefox_esr115.15, 128.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla firefox | v < 130.0 | 130.0 |
| mozilla firefox_esr | v < 115.15, 128.0 ≤ v < 128.2 | 115.15, 128.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.