PT-2024-4247 · Mozilla+11 · Firefox+14

Thomas Rinsma · Published 2023-10-30 · Updated 2026-02-02 · CVE-2024-4367

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

Alma Linux (affected versions not specified) Debian firefox-esr versions 115.11.0esr-1~deb10u1 Mozilla Firefox (affected versions not specified) Mozilla Thunderbird (affected versions not specified) Network Security Services (NSS) (affected versions not specified) openSUSE (affected versions not specified) Rocky Linux (affected versions not specified) SUSE (affected versions not specified)

Description:

Multiple security issues have been identified and addressed in recent updates for various software packages, including Mozilla Firefox, Mozilla Thunderbird, and Network Security Services (NSS). These vulnerabilities could potentially lead to arbitrary code execution, denial of service, or other security compromises. The updates include fixes for use-after-free vulnerabilities, denial-of-service issues, and other security flaws. The specific details of these vulnerabilities are extensive and encompass a range of components within the affected software. The updates address issues such as HTTP/2 frame handling, animation timeline vulnerabilities, and potential memory safety concerns.

Recommendations:

• Upgrade Mozilla Firefox to the latest available version.
• Upgrade Mozilla Thunderbird to the latest available version.
• Upgrade Network Security Services (NSS) to the latest available version.
• Update Alma Linux packages to the latest versions.
• Update Debian firefox-esr packages to version 115.11.0esr-1~deb10u1.
• Update openSUSE packages to the latest versions.
• Update Rocky Linux packages to the latest versions.
• Update SUSE packages to the latest versions.

Exploit

Fix

Improper Check for Exceptional Conditions

Type Confusion

Weakness Enumeration

CWE-754

CWE-843

Related Identifiers

ALSA-2023_6187

ALSA-2023_6188

ALSA-2023_6191

ALSA-2023_6194

ALSA-2023_7500

ALSA-2023_7501

ALSA-2023_7507

ALSA-2023_7508

ALSA-2024:2883

ALSA-2024:2888

ALSA-2024:3783

ALSA-2024:3784

ALSA-2024_0001

ALSA-2024_0003

ALSA-2024_0012

ALSA-2024_0025

ALSA-2024_0105

ALSA-2024_0108

ALSA-2024_0602

ALSA-2024_0603

ALSA-2024_0608

ALSA-2024_0609

ALSA-2024_0786

ALSA-2024_0790

ALSA-2024_0952

ALSA-2024_0955

ALSA-2024_0963

ALSA-2024_0964

ALSA-2024_1484

ALSA-2024_1485

ALSA-2024_1493

ALSA-2024_1494

ALSA-2024_1908

ALSA-2024_1912

ALSA-2024_1939

ALSA-2024_1940

ALSA-2024_2883

ALSA-2024_2888

ALSA-2024_3783

ALSA-2024_3784

ALSA-2024_3954

ALSA-2024_3955

ALSA-2024_4002

ALSA-2024_4036

ALSA-2024_4500

ALSA-2024_4517

ALSA-2024_4624

ALSA-2024_4635

ALSA-2024_5322

ALSA-2024_5391

ALSA-2024_5392

ALSA-2024_5402

ALSA-2024_6681

ALSA-2024_6682

ALSA-2024_6683

ALSA-2024_6684

ALSA-2024_7505

ALSA-2024_7552

ALSA-2024_7699

ALSA-2024_7700

ALSA-2024_7958

ALSA-2024_7977

ALSA-2024_8024

ALSA-2024_8025

ALSA-2024_8726

ALSA-2024_8729

ALSA-2024_8790

ALSA-2024_8793

ALSA-2024_9552

ALSA-2024_9554

ALSA-2025_16880

ALSA-2025_18155

ALSA-2025_18285

ALSA-2025_18321

ALSA-2025_18983

ALT-PU-2024-13897

ALT-PU-2024-14442

ALT-PU-2024-14892

ALT-PU-2024-15175

ALT-PU-2024-15839

ALT-PU-2024-15841

ALT-PU-2024-7772

ALT-PU-2024-7980

ALT-PU-2024-7982

BDU:2024-04733

CESA-2024_3783

CESA-2024_3784

CVE-2024-4367

DLA-3815-1

DLA-3817-1

DSA-5691-1

DSA-5693-1

DSA-5742-1

ELSA-2024-2881

ELSA-2024-2883

ELSA-2024-2888

ELSA-2024-2913

ELSA-2024-3783

ELSA-2024-3784

GHSA-WGRM-67XF-HHPQ

INFSA-2024_2883

INFSA-2024_2888

INFSA-2024_3783

INFSA-2024_3784

MGASA-2024-0189

MGASA-2024-0191

OESA-2024-2523

OESA-2025-1265

OESA-2025-1268

OPENSUSE-SU-2024:13980-1

OPENSUSE-SU-2024:13981-1

OPENSUSE-SU-2024:14572-1

OPENSUSE-SU-2024_1770-1

OPENSUSE-SU-2024_1858-1

RHSA-2024:2881

RHSA-2024:2882

RHSA-2024:2883

RHSA-2024:2884

RHSA-2024:2885

RHSA-2024:2886

RHSA-2024:2887

RHSA-2024:2888

RHSA-2024:2903

RHSA-2024:2904

RHSA-2024:2905

RHSA-2024:2906

RHSA-2024:2911

RHSA-2024:2912

RHSA-2024:2913

RHSA-2024:3338

RHSA-2024:3783

RHSA-2024:3784

RHSA-2024_2881

RHSA-2024_2883

RHSA-2024_2888

RHSA-2024_2913

RHSA-2024_3783

RHSA-2024_3784

RLSA-2024:2888

RLSA-2024:3783

RLSA-2024:3784

RLSA-2024_2888

RLSA-2024_3783

RLSA-2024_3784

SUSE-SU-2024:1676-1

SUSE-SU-2024:1770-1

SUSE-SU-2024:1858-1

SUSE-SU-2024_1676-1

SUSE-SU-2024_1770-1

SUSE-SU-2024_1858-1

USN-6779-1

USN-6779-2

USN-6782-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Confluence

Firefox

Firefox Esr

Linuxmint

Pdf.Js

Red Hat

Red Os

Rocky Linux

Suse

Thunderbird

Ubuntu

References · 2252

• 🔥 https://github.com/LOURC0D3/CVE-2024-4367-PoC · Exploit
• 🔥 https://github.com/s4vvysec/CVE-2024-4367-POC · Exploit
• 🔥 https://github.com/Zombie-Kaiser/cve-2024-4367-PoC-fixed · Exploit
• 🔥 https://github.com/spaceraccoon/detect-cve-2024-4367 · Exploit
• 🔥 https://github.com/snyk-labs/pdfjs-vuln-demo · Exploit
• 🔥 https://github.com/clarkio/pdfjs-vuln-demo · Exploit
• 🔥 https://github.com/UnHackerEnCapital/PDFernetRemotelo · Exploit
• 🔥 https://exploit-db.com/exploits/52273 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-32208 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-10464 · Security Note
• https://osv.dev/vulnerability/DSA-5742-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32210 · Security Note
• https://osv.dev/vulnerability/DLA-3817-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-4773 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45417 · Security Note