PT-2024-10064 · Mozilla+4 · Thunderbird+5

Daniel Holbert · Published 2024-11-25 · Updated 2025-11-19 · CVE-2024-11701

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 133 Thunderbird versions prior to 133

Description The vulnerability is related to the incorrect display of a domain in the address bar during an interrupted navigation attempt, potentially leading to user confusion and spoofing attacks. This issue may allow a remote attacker to conduct spoofing attacks due to inadequate authentication procedure and incorrect domain name display in the address bar.

Recommendations For Firefox versions prior to 133, update to a version that includes the fix for this issue. For Thunderbird versions prior to 133, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to sensitive information until the issue is resolved.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

ALT-PU-2024-16375

ALT-PU-2025-11100

ALT-PU-2025-14599

ALT-PU-2025-2230

ALT-PU-2025-5137

ALT-PU-2025-7695

BDU:2025-00202

CVE-2024-11701

OPENSUSE-SU-2024:14583-1

USN-7134-1

Affected Products

Alt Linux

Astra Linux

Firefox

Linuxmint

Thunderbird

Ubuntu

References · 56

• https://mozilla.org/en-US/security/advisories/mfsa2024-63 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2024-67 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-11708 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-11701 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0411SE18 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2024-63/#CVE-2024-11701 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-11696 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7134-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-11699 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-11701 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-11706 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2024-63 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2024-67 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-11704 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-11692 · Vendor Advisory