A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

References

bugzilla.mozilla.org/show_bug.cgi?id=1893645

ubuntu.com/security/CVE-2024-4367

ubuntu.com/security/notices/USN-6779-1

ubuntu.com/security/notices/USN-6782-1

www.cve.org/CVERecord?id=CVE-2024-4367

www.mozilla.org/en-US/security/advisories/mfsa2024-21/#CVE-2024-4367

www.mozilla.org/en-US/security/advisories/mfsa2024-22/#CVE-2024-4367

www.mozilla.org/en-US/security/advisories/mfsa2024-23/#CVE-2024-4367

www.mozilla.org/security/advisories/mfsa2024-21/

www.mozilla.org/security/advisories/mfsa2024-22/

www.mozilla.org/security/advisories/mfsa2024-23/

osv 22

githubexploit 10

veracode 2

github 3

cve 2

nvd 2

vulnrichment 2

cvelist 2

nessus 54

redhatcve 1

debiancve 1

openvas 23

wpvulndb 1

ibm 2

ubuntucve 1

thn 1

almalinux 4

oraclelinux 6

redhat 18

ubuntu 3

rocky 3

slackware 2

amazon 1

debian 4

freebsd 1

kaspersky 3

mageia 2

mozilla 3

wordfence 1

osv

react-pdf vulnerable to arbitrary JavaScript execution upon opening a malicious PDF with PDF.js

2024-05-07 16:48:59

PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

2024-05-07 10:25:08

CVE-2024-34342

2024-05-07 15:15:09

githubexploit

Exploit for CVE-2024-4367

2024-05-20 10:02:23

Exploit for CVE-2024-4367

2024-05-20 22:56:10

Exploit for CVE-2024-4367

2024-05-22 18:05:47

veracode

Arbitrary JavaScript Execution

2024-05-08 05:55:21

Remote Code Execution (RCE)

2024-05-08 04:43:35

github

react-pdf vulnerable to arbitrary JavaScript execution upon opening a malicious PDF with PDF.js

2024-05-07 16:48:59

Arbitrary JavaScript execution due to using outdated libraries

2024-06-05 14:15:50

PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

2024-05-07 10:25:08

cve

CVE-2024-34342

2024-05-07 15:15:09

CVE-2024-4367

2024-05-14 18:15:12

nvd

CVE-2024-34342

2024-05-07 15:15:09

CVE-2024-4367

2024-05-14 18:15:12

vulnrichment

CVE-2024-34342 react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

2024-05-07 14:29:06

CVE-2024-4367

2024-05-14 17:21:23

cvelist

CVE-2024-34342 react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

2024-05-07 14:29:06

CVE-2024-4367

2024-05-14 17:21:23

nessus

Debian dsa-5742 : odoo-14 - security update

2024-08-08 00:00:00

Debian dla-3815 : firefox-esr - security update

2024-05-16 00:00:00

RHEL 8 : firefox (RHSA-2024:3783)

2024-06-10 00:00:00

redhatcve

CVE-2024-4367

2024-05-14 18:54:47

debiancve

CVE-2024-4367

2024-05-14 18:15:12

openvas

Debian: Security Advisory (DSA-5742-1)

2024-08-09 00:00:00

Debian: Security Advisory (DLA-3817-1)

2024-05-21 00:00:00

Mageia: Security Advisory (MGASA-2024-0191)

2024-05-22 00:00:00

wpvulndb

PDF.js < 4.2.67 - Arbitrary JavaScript Execution

2024-06-03 00:00:00

ibm

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pdfjs-dist

2024-09-20 21:17:11

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Mozilla Firefox arbitrary code execution vulnerability [CVE-2024-4367]

2024-08-05 21:42:56

ubuntucve

CVE-2024-4367

2024-05-14 00:00:00

thn

Researchers Uncover Flaws in Python Package for AI Models and PDF.js Used by Firefox

2024-05-21 10:22:00

almalinux

Moderate: firefox security update

2024-06-10 00:00:00

Important: thunderbird security update

2024-05-16 00:00:00

Moderate: thunderbird security update

2024-06-10 00:00:00

oraclelinux

thunderbird security update

2024-05-20 00:00:00

firefox security update

2024-06-11 00:00:00

firefox security update

2024-05-16 00:00:00

redhat

(RHSA-2024:2913) Important: thunderbird security update

2024-05-20 07:31:47

(RHSA-2024:2912) Important: thunderbird security update

2024-05-20 07:31:21

(RHSA-2024:3338) Moderate: thunderbird security update

2024-05-23 12:00:18

ubuntu

Thunderbird vulnerabilities

2024-05-22 00:00:00

Firefox regressions

2024-05-29 00:00:00

Firefox vulnerabilities

2024-05-21 00:00:00

rocky

thunderbird security update

2024-06-14 13:59:30

firefox security update

2024-06-14 13:59:30

thunderbird security update

2024-06-14 14:00:40

slackware

[slackware-security] mozilla-firefox

2024-05-14 19:27:14

[slackware-security] mozilla-thunderbird

2024-06-12 21:36:48

amazon

Important: thunderbird

2024-06-06 20:17:00

debian

[SECURITY] [DSA 5691-1] firefox-esr security update

2024-05-15 17:48:47

[SECURITY] [DSA 5693-1] thunderbird security update

2024-05-17 17:04:52

[SECURITY] [DLA 3817-1] thunderbird security update

2024-05-20 08:15:13

freebsd

Gitlab -- Vulnerabilities

2024-05-22 00:00:00

kaspersky

KLA67587 Multiple vulnerabilities in Mozilla Firefox ESR

2024-05-14 00:00:00

KLA67450 Multiple vulnerabilities in Mozilla Thunderbird

2024-05-15 00:00:00

KLA67588 Multiple vulnerabilities in Mozilla Firefox

2024-05-14 00:00:00

mageia

Updated thunderbird packages fix security vulnerabilities

2024-05-22 02:38:02

Updated nss & firefox packages fix security vulnerabilities

2024-05-22 02:17:20

mozilla

Security Vulnerabilities fixed in Thunderbird 115.11 — Mozilla

2024-05-15 00:00:00

Security Vulnerabilities fixed in Firefox ESR 115.11 — Mozilla

2024-05-14 00:00:00

Security Vulnerabilities fixed in Firefox 126 — Mozilla

2024-05-14 00:00:00

wordfence

Wordfence Intelligence Weekly WordPress Vulnerability Report (May 20, 2024 to May 26, 2024)

2024-05-30 15:23:45

Solutions

Vulnerabilities intelligence
Perimeter control tool
Linux scanner
Windows scanner
Developers SDK
Security Intelligence feeds

Database

Vulnerabilities
Exploits
Security News
BugBounty
Wild Exploited
Top Vulnerabilities
CVE Feed

Resources

Statics & Sources
Plugins
API docs
FAQ
Blog
Glossary

Company

About
Contacts
Pricing
EULA
Privacy Policy
Submission Policy
OpenSource

@2024 Vulners Inc

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

AI Score

6.5

Confidence

Low

JSON

Related for OSV:CVE-2024-4367