CVE-2024-9680

Name	CVE-2024-9680
Description	An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, and Firefox ESR < 115.16.1.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
firefox (PTS)	sid	131.0.2-1	fixed
firefox-esr (PTS)	bullseye	115.14.0esr-1~deb11u1	vulnerable
	bullseye (security)	128.3.0esr-1~deb11u2	vulnerable
	bookworm	115.14.0esr-1~deb12u1	vulnerable
	bookworm (security)	128.3.0esr-1~deb12u1	vulnerable
	trixie	128.3.0esr-2	vulnerable
	sid	128.3.1esr-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
firefox	source	(unstable)	131.0.2-1
firefox-esr	source	(unstable)	128.3.1esr-1

https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/