Vulnerability CVE-2024-3302: Information

Description

There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-3302
Published: April 16, 2024
Modified: April 24, 2024

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus125.0.1-alt1126.0.1-alt1ALT-PU-2024-6765-2345346Fixed
firefoxsisyphus_riscv64125.0.3-alt0.port126.0-alt0.portALT-PU-2024-7882-1-Fixed
firefoxsisyphus_loongarch64125.0.1-alt1.0.port126.0-alt1.0.portALT-PU-2024-7109-1-Fixed
firefoxp11125.0.1-alt1126.0.1-alt1ALT-PU-2024-6765-2345346Fixed
firefox-esrsisyphus115.10.0-alt1115.11.0-alt1ALT-PU-2024-6719-2344912Fixed
firefox-esrsisyphus_loongarch64115.10.0-alt1115.11.0-alt1ALT-PU-2024-6794-1-Fixed
firefox-esrp10115.10.0-alt1115.11.0-alt1ALT-PU-2024-6721-3345277Fixed
firefox-esrp11115.10.0-alt1115.11.0-alt1ALT-PU-2024-6719-2344912Fixed
palemoonsisyphus33.1.0-alt133.1.0-alt1ALT-PU-2024-7489-2347518Fixed
palemoonp1033.1.0-alt133.1.0-alt1ALT-PU-2024-7685-3347847Fixed
palemoonp1133.1.0-alt133.1.0-alt1ALT-PU-2024-7489-2347518Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1881183
    VU#421644 - HTTP/2 CONTINUATION frames can be utilized for DoS attacks
      https://www.mozilla.org/security/advisories/mfsa2024-18/
        https://www.mozilla.org/security/advisories/mfsa2024-19/
          https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html
            https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html
              https://www.mozilla.org/security/advisories/mfsa2024-20/
                VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
                Version: v24.5.3
                Back to top