Unrated severityNVD Advisory· Published Jul 9, 2024· Updated Oct 30, 2025

Memory corruption in thread creation

CVE-2024-6603

Description

In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

Affected products

osv-coords50 versions
pkg:apk/chainguard/firefox pkg:apk/chainguard/firefox-esr pkg:apk/wolfi/firefox pkg:rpm/almalinux/firefox pkg:rpm/almalinux/firefox-x11 pkg:rpm/almalinux/thunderbird pkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/MozillaFirefox-branding-SLE&distro=openSUSE%20Leap%2015.5 pkg:rpm/opensuse/MozillaFirefox-branding-SLE&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Leap%2015.5 pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2015.5 pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweed pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP5 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP6 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP5 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP6 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP5 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP5 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP6
< 128.0-r0+ 49 more
- (no CPE)range: < 128.0-r0
- (no CPE)range: < 128.0-r0
- (no CPE)range: < 128.0-r0
- (no CPE)range: < 115.13.0-3.el9_4.alma.1
- (no CPE)range: < 115.13.0-3.el9_4.alma.1
- (no CPE)range: < 115.13.0-3.el9_4.alma.1
- (no CPE)range: < 128.5.1-1.1
- (no CPE)range: < 128-150200.9.16.1
- (no CPE)range: < 128-150200.9.16.1
- (no CPE)range: < 115.13.0-150200.152.143.1
- (no CPE)range: < 115.13.0-150200.152.143.1
- (no CPE)range: < 128.0-1.1
- (no CPE)range: < 115.13.0-150200.8.171.4
- (no CPE)range: < 115.13.0-150200.8.171.4
- (no CPE)range: < 115.13.0-1.1
- (no CPE)range: < 128-150200.9.16.1
- (no CPE)range: < 128-150200.9.16.1
- (no CPE)range: < 128-150200.9.16.1
- (no CPE)range: < 128-150200.9.16.1
- (no CPE)range: < 128-150200.9.16.1
- (no CPE)range: < 128-150200.9.16.1
- (no CPE)range: < 128-150200.9.16.1
- (no CPE)range: < 128-35.15.1
- (no CPE)range: < 128-150200.9.16.1
- (no CPE)range: < 128-150200.9.16.1
- (no CPE)range: < 128-150200.9.16.1
- (no CPE)range: < 128-35.15.1
- (no CPE)range: < 128-150200.9.16.1
- (no CPE)range: < 128-150200.9.16.1
- (no CPE)range: < 128-150200.9.16.1
- (no CPE)range: < 115.13.0-150200.152.143.1
- (no CPE)range: < 115.13.0-150200.152.143.1
- (no CPE)range: < 115.13.0-150200.152.143.1
- (no CPE)range: < 115.13.0-150200.152.143.1
- (no CPE)range: < 115.13.0-150200.152.143.1
- (no CPE)range: < 115.13.0-150200.152.143.1
- (no CPE)range: < 115.13.0-150200.152.143.1
- (no CPE)range: < 115.13.0-112.218.1
- (no CPE)range: < 115.13.0-150200.152.143.1
- (no CPE)range: < 115.13.0-150200.152.143.1
- (no CPE)range: < 115.13.0-150200.152.143.1
- (no CPE)range: < 115.13.0-112.218.1
- (no CPE)range: < 115.13.0-150200.152.143.1
- (no CPE)range: < 115.13.0-150200.152.143.1
- (no CPE)range: < 115.13.0-150200.152.143.1
- (no CPE)range: < 115.13.0-112.218.1
- (no CPE)range: < 115.13.0-150200.8.171.4
- (no CPE)range: < 115.13.0-150200.8.171.4
- (no CPE)range: < 115.13.0-150200.8.171.4
- (no CPE)range: < 115.13.0-150200.8.171.4
Mozilla Corporation/Firefoxv5
Range: unspecified
Mozilla Corporation/Thunderbirdv5
Range: unspecified
Mozilla Corporation/Firefox Esrcpe-rescue
Range: unspecified

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000