MFSA2024-29 Firefox: Security Vulnerabilities fixed in Firefox 128 (CVE-2024-6607)

MFSA2024-29 Firefox: Security Vulnerabilities fixed in Firefox 128 (CVE-2024-6607)

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

07/09/2024

Created

07/10/2024

Added

07/10/2024

Modified

07/18/2024

Description

It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a `&lt;select&gt;` element over certain permission prompts. This could be used to confuse a user into giving a site unintended permissions. This vulnerability affects Firefox < 128 and Thunderbird < 128.

Solution(s)

• mozilla-firefox-upgrade-128_0

References

• https://attackerkb.com/topics/cve-2024-6607
• CVE - 2024-6607
• http://www.mozilla.org/security/announce/2024/mfsa2024-29.html