CVE-2024-2608

What it actually does

Integer overflows in AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding() and AppendEncodedCharacters() cause underallocation of an output buffer, resulting in an out-of-bounds write.

Why it matters to the business

Attackers may achieve remote code execution or cause crashes in widely used browsers and email clients, leading to potential data theft, system compromise, or operational disruption for end users and organizations.

How an attack unfolds

An attacker crafts malicious HTML, XML or text content containing specially chosen attribute values or characters that trigger the integer overflow during encoding, underallocating the destination buffer and enabling an out-of-bounds write that can be turned into arbitrary code execution.

How to fix it

Upgrade Firefox to 124 or later, Firefox ESR to 115.9 or later, and Thunderbird to 115.9 or later. Apply the fixed package versions supplied by your distribution when available.

How to confirm the fix worked

Confirm that installed browser and email client versions meet or exceed the fixed releases; re-test affected encoding paths with known triggering inputs after the update.

Typical attack path

1. Serve malicious webpage or email attachment to a target user
2. Trigger AppendEncodedAttributeValue, ExtraSpaceNeededForAttrEncoding or AppendEncodedCharacters with the crafted input
3. Exploit the resulting out-of-bounds write to corrupt memory and execute attacker-controlled code

How to detect it

Review browser and Thunderbird crash reports for faults occurring inside the named encoding functions; correlate with access to suspicious external content in web or mail logs.

What your security team should do

• Immediately deploy the listed fixed versions across all Firefox, ESR and Thunderbird installations
• Prioritize user populations that handle untrusted web or email content
• Monitor Mozilla advisories for any follow-on updates