Fluid Attacks Database

Description

When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox < 128 and Thunderbird < 128.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	nss	=2:3.61-1 \|\| =2:3.61-1+deb11u1 \|\| =2:3.61-1+deb11u2 \|\| =2:3.61-1+deb11u3 \|\| >=0 <2:3.61-1+deb11u4	2:3.61-1+deb11u4
debian 12	nss	=2:3.87.1-1 \|\| >=0 <2:3.87.1-1+deb12u1	2:3.87.1-1+deb12u1
debian 13	nss	>=0 <2:3.101-1	2:3.101-1
debian 14	nss	>=0 <2:3.101-1	2:3.101-1

Aliases

1. CVE-2024-66092. NVD-2024-66093. OSV-DEBIAN-2024-66094. OSV-2024-66095. SECURITY-TRACKER-CVE-2024-6609

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.