Mozilla is known for its commitment to security, but like any software project, sometimes serious bugs get through the cracks. One such case is tracked as CVE-2024-6604 — a collection of memory safety bugs lurking within several popular versions of Firefox and Thunderbird. If you use either application, this is a vulnerability you really should know about.

What is CVE-2024-6604?

CVE-2024-6604 refers to a set of memory safety bugs discovered in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. A memory safety bug is an error in the code that deals with how a program manages memory. When these bugs are present, malicious input can cause Firefox or Thunderbird to misbehave. In the worst-case scenario, they can let an attacker run their own code on your computer.

Mozilla's own security advisories make it clear:
> "Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code."

Thunderbird < 128

Essentially, if you’re not on the very latest release, you might be at risk!

What Causes Memory Safety Bugs?

Programs like Firefox and Thunderbird are written in C++ and Rust, highly performant languages but sometimes hard to write safely — especially when juggling web content from countless sources.

A common example is this sort of C++ code

char data[100];
strcpy(data, user_supplied_input);

Here, if user_supplied_input is longer than 100 characters, the program writes beyond the end of the data array, corrupting memory it shouldn’t touch. This is called a buffer overflow.

Execute arbitrary code (the worst case)

In the wild, an attacker might create a web page or email that, when opened with an old version of Firefox or Thunderbird, triggers the bug. If crafted just right, this page or message could overwrite sensitive parts of memory and take control.

Here’s a simplified, theoretical exploit path an attacker might use

// A web page loads a massive image with malformed data
let img = new Image();
img.src = very_long_malicious_string; // Triggers memory bug in the underlying image decoder

document.body.appendChild(img);

// A real exploit would likely use WebAssembly or heap-spraying to control memory layout and take over execution.

A successful attack could cause the browser to download and run malicious software — in the background, without any user warning.

Are There Public Exploits?

As of now, there are no known public exploits that reliably use CVE-2024-6604 to take over targeted computers. But security researchers agree: It’s only a matter of time.

- Mozilla Security Advisory 2024-25 (see "Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 128")
- CVE-2024-6604 on NVD (awaiting full details)

What Should You Do?

Update, update, update!

Thunderbird 128 or Thunderbird 115.13 or later

You can check your version by going to Help → About in either app.

Final Thoughts

Memory safety bugs like those covered by CVE-2024-6604 are a reminder that even top-tier open-source software can be vulnerable. Attackers are always hunting for bugs like these — and in the past, similar bugs in Firefox have been used for remote hacking and surveillance (case in point).

Don’t wait:
Make sure all your Mozilla products are up to date. Stay safe, and keep an eye on future advisories.

Sources

- Mozilla Security Advisories
- NVD Entry for CVE-2024-6604
- Exploit Techniques: Buffer Overflow

*This article is exclusive and written in plain language to help everyone understand these critical security updates.*

Timeline

Published on: 07/09/2024 15:15:12 UTC
Last modified on: 11/12/2024 16:35:25 UTC