Log in Start free

Vulnerability · Published Nov 26, 2024 · Assigned by mozilla

CVE-2024-11696

Medium 5.4

In plain English

A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.4%top 69.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8firefox128.5.1-1.el8_10ALSA-2024:10752
AlmaLinux:9firefox128.5.1-1.el9_5ALSA-2024:10702
AlmaLinux:9firefox-x11128.5.1-1.el9_5ALSA-2024:10702
AlmaLinux:10qemu-guest-agent18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-img18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm-audio-pa18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm-block-blkio18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm-block-curl18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm-block-rbd18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm-common18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm-core18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm-device-display-virtio-gpu18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm-device-display-virtio-gpu-ccw18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm-device-display-virtio-gpu-pci18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm-device-display-virtio-vga18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm-device-usb-host18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm-device-usb-redirect18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm-docs18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm-tools18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm-ui-egl-headless18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-kvm-ui-opengl18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:10qemu-pr-helper18:10.1.0-16.el10_2.alma.1ALSA-2026:18479
AlmaLinux:8thunderbird128.5.0-1.el8_10.alma.1ALSA-2024:10591
AlmaLinux:9thunderbird128.5.0-1.el9_5.alma.1ALSA-2024:10592
Alpine:v3.20thunderbird128.5.0-r0ALPINE-CVE-2024-11696
Alpine:v3.21thunderbird128.5.0-r0ALPINE-CVE-2024-11696
Alpine:v3.22thunderbird128.5.0-r0ALPINE-CVE-2024-11696
Alpine:v3.23thunderbird128.5.0-r0ALPINE-CVE-2024-11696
Debian:12firefox-esr128.5.0esr-1~deb12u1DSA-5820-1
Debian:12firefox-esr128.5.0esr-1~deb12u1DEBIAN-CVE-2024-11696
Debian:13firefox-esr128.5.0esr-1DEBIAN-CVE-2024-11696
Debian:14firefox-esr128.5.0esr-1DEBIAN-CVE-2024-11696
Debian:12thunderbird1:128.5.0esr-1~deb12u1DSA-5821-1
Debian:12thunderbird1:128.5.0esr-1~deb12u1DEBIAN-CVE-2024-11696
Debian:13thunderbird1:128.5.0esr-1DEBIAN-CVE-2024-11696
Debian:14thunderbird1:128.5.0esr-1DEBIAN-CVE-2024-11696
Rocky Linux:8firefox0:128.5.1-1.el8_10RLSA-2024:10752
Rocky Linux:10qemu-kvm8:10.1.0-16.el10_2RLSA-2026:18479
Ubuntu:22.04:LTSmozjs102no fix listedUBUNTU-CVE-2024-11696
Ubuntu:24.04:LTSmozjs102no fix listedUBUNTU-CVE-2024-11696
Ubuntu:24.04:LTSmozjs115no fix listedUBUNTU-CVE-2024-11696
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2024-11696
Ubuntu:22.04:LTSmozjs91no fix listedUBUNTU-CVE-2024-11696

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 133
Mozilla Firefox ESR unspecified – before 128.5
Mozilla Thunderbird unspecified – before 133
Mozilla Thunderbird unspecified – before 128.5

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References