openEuler 24.03 LTS update for firefox

Published: 2025-03-07

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2024-5692 CVE-2024-6603
CWE-ID	CWE-254 CWE-119
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	openEuler Operating systems & Components / Operating system firefox-debugsource Operating systems & Components / Operating system package or component firefox-debuginfo Operating systems & Components / Operating system package or component firefox Operating systems & Components / Operating system package or component
Vendor	openEuler

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Security features bypass

EUVDB-ID: #VU91732

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-5692

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error when parsing file names using the Save As functionality on Windows 10. A remote attacker can trick the victim into saving the file with a disallowed extension such as .url by including an invalid character in the extension.

Note, the vulnerability affects only Windows installations of Firefox.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

firefox-debugsource: before 128.7.0-1

firefox-debuginfo: before 128.7.0-1

firefox: before 128.7.0-1

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1258

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU93897