Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-WGRM-67XF-HHPQ
HistoryMay 07, 2024 - 10:25 a.m.

PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

2024-05-0710:25:08
GitHub Advisory Database
github.com
72
pdf.js
javascript
malicious pdf
vulnerability
patch
eval
workaround
bugzilla
mozilla
hosting domain
reference

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.4%

JSON

Impact

If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Patches

The patch removes the use of eval:
https://github.com/mozilla/pdf.js/pull/18015

Workarounds

Set the option isEvalSupported to false.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

Affected configurations

Vulners
Node
pdfjsdistRange≤4.1.392
CPENameOperatorVersion
pdfjs-distle4.1.392

Related

github 1
veracode 1
redhatcve 1
githubexploit 3
debiancve 1
osv 18
wpvulndb 1
cve 1
vulnrichment 1
cvelist 1
ubuntucve 1
nvd 1
thn 1
mozilla 3
openvas 21
redhat 16
debian 4
nessus 53
mageia 2
rocky 1
kaspersky 3
oraclelinux 6
slackware 2
freebsd 1
almalinux 4
ubuntu 3
amazon 1
wordfence 1
github
github
Arbitrary JavaScript execution due to using outdated libraries
2024-06-05 14:15:50
veracode
veracode
Remote Code Execution (RCE)
2024-05-08 04:43:35
redhatcve
redhatcve
CVE-2024-4367
2024-05-14 18:54:47
githubexploit
githubexploit
Exploit for CVE-2024-4367
2024-05-20 10:02:23
Exploit for CVE-2024-4367
2024-05-20 22:56:10
Exploit for CVE-2024-4367
2024-05-22 18:05:47
debiancve
debiancve
CVE-2024-4367
2024-05-14 18:15:12
osv
osv
Arbitrary JavaScript execution due to using outdated libraries
2024-06-05 14:15:50
CVE-2024-34342
2024-05-07 15:15:09
react-pdf vulnerable to arbitrary JavaScript execution upon opening a malicious PDF with PDF.js
2024-05-07 16:48:59
wpvulndb
wpvulndb
PDF.js < 4.2.67 - Arbitrary JavaScript Execution
2024-06-03 00:00:00
cve
cve
CVE-2024-4367
2024-05-14 18:15:12
vulnrichment
vulnrichment
CVE-2024-4367
2024-05-14 17:21:23
cvelist
cvelist
CVE-2024-4367
2024-05-14 17:21:23
ubuntucve
ubuntucve
CVE-2024-4367
2024-05-14 00:00:00
nvd
nvd
CVE-2024-4367
2024-05-14 18:15:12
thn
thn
Researchers Uncover Flaws in Python Package for AI Models and PDF.js Used by Firefox
2024-05-21 10:22:00
mozilla
mozilla
Security Vulnerabilities fixed in Firefox ESR 115.11 — Mozilla
2024-05-14 00:00:00
Security Vulnerabilities fixed in Thunderbird 115.11 — Mozilla
2024-05-15 00:00:00
Security Vulnerabilities fixed in Firefox 126 — Mozilla
2024-05-14 00:00:00
openvas
openvas
Slackware: Security Advisory (SSA:2024-135-01)
2024-05-15 00:00:00
Mozilla Firefox ESR Security Update (mfsa_2024-22) - Mac OS X
2024-05-17 00:00:00
Mozilla Thunderbird Security Update (mfsa_2024-23) - Windows
2024-05-17 00:00:00
redhat
redhat
(RHSA-2024:2886) Important: firefox security update
2024-05-16 11:24:44
(RHSA-2024:2885) Important: firefox security update
2024-05-16 11:24:38
(RHSA-2024:2905) Important: thunderbird security update
2024-05-20 01:02:21
debian
debian
[SECURITY] [DLA 3815-1] firefox-esr security update
2024-05-16 07:16:17
[SECURITY] [DSA 5693-1] thunderbird security update
2024-05-17 17:04:52
[SECURITY] [DSA 5691-1] firefox-esr security update
2024-05-15 17:48:47
nessus
nessus
CentOS 7 : firefox (RHSA-2024:2881)
2024-05-16 00:00:00
RHEL 8 : firefox (RHSA-2024:2886)
2024-05-16 00:00:00
RHEL 8 : firefox (RHSA-2024:2885)
2024-05-16 00:00:00
mageia
mageia
Updated nss & firefox packages fix security vulnerabilities
2024-05-22 02:17:20
Updated thunderbird packages fix security vulnerabilities
2024-05-22 02:38:02
rocky
rocky
thunderbird security update
2024-06-14 14:00:40
kaspersky
kaspersky
KLA67450 Multiple vulnerabilities in Mozilla Thunderbird
2024-05-15 00:00:00
KLA67587 Multiple vulnerabilities in Mozilla Firefox ESR
2024-05-14 00:00:00
KLA67588 Multiple vulnerabilities in Mozilla Firefox
2024-05-14 00:00:00
oraclelinux
oraclelinux
firefox security update
2024-05-16 00:00:00
thunderbird security update
2024-05-20 00:00:00
thunderbird security update
2024-06-11 00:00:00
slackware
slackware
[slackware-security] mozilla-thunderbird
2024-06-12 21:36:48
[slackware-security] mozilla-firefox
2024-05-14 19:27:14
freebsd
freebsd
Gitlab -- Vulnerabilities
2024-05-22 00:00:00
almalinux
almalinux
Moderate: thunderbird security update
2024-06-10 00:00:00
Important: thunderbird security update
2024-05-16 00:00:00
Moderate: firefox security update
2024-06-10 00:00:00
ubuntu
ubuntu
Thunderbird vulnerabilities
2024-05-22 00:00:00
Firefox vulnerabilities
2024-05-21 00:00:00
Firefox regressions
2024-05-29 00:00:00
amazon
amazon
Important: thunderbird
2024-06-06 20:17:00
wordfence
wordfence
Wordfence Intelligence Weekly WordPress Vulnerability Report (May 20, 2024 to May 26, 2024)
2024-05-30 15:23:45

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.4%

JSON
Related for GHSA-WGRM-67XF-HHPQ
github1veracode1redhatcve1githubexploit3debiancve1osv18wpvulndb1cve1vulnrichment1cvelist1ubuntucve1nvd1thn1mozilla3openvas21redhat16debian4nessus53mageia2rocky1kaspersky3oraclelinux6slackware2freebsd1almalinux4ubuntu3amazon1wordfence1