CVE-2024-43357 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2024-43357 Interim 1 6 2025-04-30T23:35:51Z current 2024-09-10T23:11:21Z 2025-04-30T23:35:51Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2024-43357 ECMA-262 is the language specification for the scripting language ECMAScript. A problem in the ECMAScript (JavaScript) specification of async generators, introduced by a May 2021 spec refactor, may lead to mis-implementation in a way that could present as a security vulnerability, such as type confusion and pointer dereference. The internal async generator machinery calls regular promise resolver functions on IteratorResult (`{ done, value }`) objects that it creates, assuming that the IteratorResult objects will not be then-ables. Unfortunately, these IteratorResult objects inherit from `Object.prototype`, so these IteratorResult objects can be made then-able, triggering arbitrary behaviour, including re-entering the async generator machinery in a way that violates some internal invariants. The ECMAScript specification is a living standard and the issue has been addressed at the time of this advisory's public disclosure. JavaScript engine implementors should refer to the latest specification and update their implementations to comply with the `AsyncGenerator` section. ## References - https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727 - https://bugzilla.mozilla.org/show_bug.cgi?id=1901411 - https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq - https://bugs.webkit.org/show_bug.cgi?id=275407 - https://issues.chromium.org/issues/346692561 - https://www.cve.org/CVERecord?id=CVE-2024-7652 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Desktop Applications 15 SP5 SUSE Linux Enterprise Workstation Extension 15 SP5 SUSE Linux Enterprise Module for Desktop Applications 15 SP6 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise Module for Desktop Applications 15 SP5 SUSE Linux Enterprise Module for Desktop Applications 15 SP6 SUSE Linux Enterprise Module for Package Hub 15 SP5 SUSE Linux Enterprise Module for Package Hub 15 SP6 SUSE Linux Enterprise Server 11 SP4 LTSS SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Module for Desktop Applications 15 SP5 SUSE Linux Enterprise Workstation Extension 15 SP5 SUSE Linux Enterprise Module for Desktop Applications 15 SP6 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server Teradata 12 SP3 SUSE Linux Enterprise Server Teradata 12 SP3-LTSS SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Module for Desktop Applications 15 SP5 SUSE Linux Enterprise Workstation Extension 15 SP5 SUSE Linux Enterprise Module for Desktop Applications 15 SP6 openSUSE Leap 15.5 openSUSE Leap 15.6 MozillaFirefox MozillaFirefox-branding-upstream MozillaFirefox-buildsymbols MozillaFirefox-devel MozillaFirefox-translations-common MozillaFirefox-translations-other MozillaThunderbird MozillaThunderbird-translations-common MozillaThunderbird-translations-other MozillaFirefox as a component of SUSE Linux Enterprise High Performance Computing 12 SP5 MozillaFirefox as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS MozillaFirefox as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS MozillaFirefox as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS MozillaFirefox-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS MozillaFirefox as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP5 MozillaFirefox-devel as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP5 MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP5 MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP5 MozillaFirefox as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP6 MozillaFirefox-devel as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP6 MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP6 MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP6 MozillaThunderbird as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 MozillaThunderbird-translations-common as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 MozillaThunderbird-translations-other as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 MozillaThunderbird as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 MozillaThunderbird-translations-common as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 MozillaThunderbird-translations-other as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 MozillaFirefox as a component of SUSE Linux Enterprise Server 11 SP4 LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server 12 SP2-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 12 SP2-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 12 SP2-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server 12 SP4-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 12 SP4-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 12 SP4-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server 12 SP5 MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 12 SP5 MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 12 SP5 MozillaFirefox as a component of SUSE Linux Enterprise Server 15 SP1-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 15 SP1-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 15 SP1-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server 15 SP1-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server 15 SP2-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 15 SP2-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 15 SP2-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server 15 SP2-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server 15 SP3-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 15 SP3-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 15 SP3-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server 15 SP3-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server 15 SP4-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 15 SP4-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 15 SP4-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server 15 SP4-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server 15-LTSS MozillaFirefox-devel as a component of SUSE Linux Enterprise Server 15-LTSS MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server 15-LTSS MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server 15-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server Teradata 12 SP3 MozillaFirefox as a component of SUSE Linux Enterprise Server Teradata 12 SP3-LTSS MozillaFirefox as a component of SUSE Linux Enterprise Server Teradata 15 SP4 MozillaFirefox as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 MozillaFirefox as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 MozillaFirefox-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 MozillaFirefox as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 MozillaFirefox-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 MozillaFirefox as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 MozillaFirefox-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 MozillaFirefox-translations-common as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 MozillaFirefox-translations-other as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 MozillaFirefox-devel as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 MozillaFirefox as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 MozillaThunderbird as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 MozillaThunderbird-translations-common as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 MozillaThunderbird-translations-other as a component of SUSE Linux Enterprise Workstation Extension 15 SP5 MozillaFirefox as a component of openSUSE Leap 15.5 MozillaFirefox-branding-upstream as a component of openSUSE Leap 15.5 MozillaFirefox-buildsymbols as a component of openSUSE Leap 15.5 MozillaFirefox-devel as a component of openSUSE Leap 15.5 MozillaFirefox-translations-common as a component of openSUSE Leap 15.5 MozillaFirefox-translations-other as a component of openSUSE Leap 15.5 MozillaThunderbird as a component of openSUSE Leap 15.5 MozillaThunderbird-translations-common as a component of openSUSE Leap 15.5 MozillaThunderbird-translations-other as a component of openSUSE Leap 15.5 MozillaFirefox as a component of openSUSE Leap 15.6 MozillaFirefox-branding-upstream as a component of openSUSE Leap 15.6 MozillaFirefox-buildsymbols as a component of openSUSE Leap 15.6 MozillaFirefox-devel as a component of openSUSE Leap 15.6 MozillaFirefox-translations-common as a component of openSUSE Leap 15.6 MozillaFirefox-translations-other as a component of openSUSE Leap 15.6 MozillaThunderbird as a component of openSUSE Leap 15.6 MozillaThunderbird-translations-common as a component of openSUSE Leap 15.6 MozillaThunderbird-translations-other as a component of openSUSE Leap 15.6 ECMA-262 is the language specification for the scripting language ECMAScript. A problem in the ECMAScript (JavaScript) specification of async generators, introduced by a May 2021 spec refactor, may lead to mis-implementation in a way that could present as a security vulnerability, such as type confusion and pointer dereference. The internal async generator machinery calls regular promise resolver functions on IteratorResult (`{ done, value }`) objects that it creates, assuming that the IteratorResult objects will not be then-ables. Unfortunately, these IteratorResult objects inherit from `Object.prototype`, so these IteratorResult objects can be made then-able, triggering arbitrary behaviour, including re-entering the async generator machinery in a way that violates some internal invariants. The ECMAScript specification is a living standard and the issue has been addressed at the time of this advisory's public disclosure. JavaScript engine implementors should refer to the latest specification and update their implementations to comply with the `AsyncGenerator` section. ## References - https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727 - https://bugzilla.mozilla.org/show_bug.cgi?id=1901411 - https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq - https://bugs.webkit.org/show_bug.cgi?id=275407 - https://issues.chromium.org/issues/346692561 - https://www.cve.org/CVERecord?id=CVE-2024-7652 CVE-2024-43357 SUSE Linux Enterprise High Performance Computing 12 SP5:MozillaFirefox SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:MozillaFirefox SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:MozillaFirefox-devel SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:MozillaFirefox-translations-common SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:MozillaFirefox-translations-other SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:MozillaFirefox SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:MozillaFirefox-devel SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:MozillaFirefox-translations-common SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:MozillaFirefox-translations-other SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-devel SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-common SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:MozillaFirefox-translations-other SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-devel SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-common SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:MozillaFirefox-translations-other SUSE Linux Enterprise Module for Desktop Applications 15 SP5:MozillaFirefox SUSE Linux Enterprise Module for Desktop Applications 15 SP5:MozillaFirefox-devel SUSE Linux Enterprise Module for Desktop Applications 15 SP5:MozillaFirefox-translations-common SUSE Linux Enterprise Module for Desktop Applications 15 SP5:MozillaFirefox-translations-other SUSE Linux Enterprise Module for Desktop Applications 15 SP6:MozillaFirefox SUSE Linux Enterprise Module for Desktop Applications 15 SP6:MozillaFirefox-devel SUSE Linux Enterprise Module for Desktop Applications 15 SP6:MozillaFirefox-translations-common SUSE Linux Enterprise Module for Desktop Applications 15 SP6:MozillaFirefox-translations-other SUSE Linux Enterprise Module for Package Hub 15 SP5:MozillaThunderbird SUSE Linux Enterprise Module for Package Hub 15 SP5:MozillaThunderbird-translations-common SUSE Linux Enterprise Module for Package Hub 15 SP5:MozillaThunderbird-translations-other SUSE Linux Enterprise Module for Package Hub 15 SP6:MozillaThunderbird SUSE Linux Enterprise Module for Package Hub 15 SP6:MozillaThunderbird-translations-common SUSE Linux Enterprise Module for Package Hub 15 SP6:MozillaThunderbird-translations-other SUSE Linux Enterprise Server 12 SP2-LTSS:MozillaFirefox SUSE Linux Enterprise Server 12 SP2-LTSS:MozillaFirefox-devel SUSE Linux Enterprise Server 12 SP2-LTSS:MozillaFirefox-translations-common SUSE Linux Enterprise Server 12 SP4-LTSS:MozillaFirefox SUSE Linux Enterprise Server 12 SP4-LTSS:MozillaFirefox-devel SUSE Linux Enterprise Server 12 SP4-LTSS:MozillaFirefox-translations-common SUSE Linux Enterprise Server 12 SP5:MozillaFirefox SUSE Linux Enterprise Server 12 SP5:MozillaFirefox-devel SUSE Linux Enterprise Server 12 SP5:MozillaFirefox-translations-common SUSE Linux Enterprise Server 15 SP2-LTSS:MozillaFirefox SUSE Linux Enterprise Server 15 SP2-LTSS:MozillaFirefox-devel SUSE Linux Enterprise Server 15 SP2-LTSS:MozillaFirefox-translations-common SUSE Linux Enterprise Server 15 SP2-LTSS:MozillaFirefox-translations-other SUSE Linux Enterprise Server 15 SP3-LTSS:MozillaFirefox SUSE Linux Enterprise Server 15 SP3-LTSS:MozillaFirefox-devel SUSE Linux Enterprise Server 15 SP3-LTSS:MozillaFirefox-translations-common SUSE Linux Enterprise Server 15 SP3-LTSS:MozillaFirefox-translations-other SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-devel SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-common SUSE Linux Enterprise Server 15 SP4-LTSS:MozillaFirefox-translations-other SUSE Linux Enterprise Server Teradata 12 SP3-LTSS:MozillaFirefox SUSE Linux Enterprise Server Teradata 12 SP3:MozillaFirefox SUSE Linux Enterprise Server Teradata 15 SP4:MozillaFirefox SUSE Linux Enterprise Server for SAP Applications 12 SP5:MozillaFirefox SUSE Linux Enterprise Server for SAP Applications 15 SP2:MozillaFirefox SUSE Linux Enterprise Server for SAP Applications 15 SP2:MozillaFirefox-devel SUSE Linux Enterprise Server for SAP Applications 15 SP2:MozillaFirefox-translations-common SUSE Linux Enterprise Server for SAP Applications 15 SP2:MozillaFirefox-translations-other SUSE Linux Enterprise Server for SAP Applications 15 SP3:MozillaFirefox SUSE Linux Enterprise Server for SAP Applications 15 SP3:MozillaFirefox-devel SUSE Linux Enterprise Server for SAP Applications 15 SP3:MozillaFirefox-translations-common SUSE Linux Enterprise Server for SAP Applications 15 SP3:MozillaFirefox-translations-other SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-devel SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-common SUSE Linux Enterprise Server for SAP Applications 15 SP4:MozillaFirefox-translations-other SUSE Linux Enterprise Software Development Kit 12 SP5:MozillaFirefox SUSE Linux Enterprise Software Development Kit 12 SP5:MozillaFirefox-devel SUSE Linux Enterprise Workstation Extension 15 SP5:MozillaThunderbird SUSE Linux Enterprise Workstation Extension 15 SP5:MozillaThunderbird-translations-common SUSE Linux Enterprise Workstation Extension 15 SP5:MozillaThunderbird-translations-other openSUSE Leap 15.5:MozillaFirefox openSUSE Leap 15.5:MozillaFirefox-branding-upstream openSUSE Leap 15.5:MozillaFirefox-buildsymbols openSUSE Leap 15.5:MozillaFirefox-devel openSUSE Leap 15.5:MozillaFirefox-translations-common openSUSE Leap 15.5:MozillaFirefox-translations-other openSUSE Leap 15.5:MozillaThunderbird openSUSE Leap 15.5:MozillaThunderbird-translations-common openSUSE Leap 15.5:MozillaThunderbird-translations-other openSUSE Leap 15.6:MozillaFirefox openSUSE Leap 15.6:MozillaFirefox-branding-upstream openSUSE Leap 15.6:MozillaFirefox-buildsymbols openSUSE Leap 15.6:MozillaFirefox-devel openSUSE Leap 15.6:MozillaFirefox-translations-common openSUSE Leap 15.6:MozillaFirefox-translations-other openSUSE Leap 15.6:MozillaThunderbird openSUSE Leap 15.6:MozillaThunderbird-translations-common openSUSE Leap 15.6:MozillaThunderbird-translations-other important