CVE-2024-3302

EPSS 0.1%
Veröffentlicht 16.04.2024 16:15:08
Zuletzt bearbeitet 01.04.2025 13:39:33
Quelle security@mozilla.org
CVE-Watchlists
Login
Unerledigt
Login

There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 10

NVD 3 VulnDex Vulnerability Enrichment 3

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mozilla ≫ Firefox SwEditionesr Version < 115.10

Mozilla ≫ Firefox Version < 125.0

Mozilla ≫ Thunderbird Version <= 115.10

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.1%	0.274

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	3.7	2.2	1.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html

Mailing List

https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html

Mailing List

https://www.mozilla.org/security/advisories/mfsa2024-19/

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2024-20/

Vendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=1881183

Issue Tracking

https://kb.cert.org/vuls/id/421644

US Government Resource