PT-2024-9372 · Mozilla+4 · Thunderbird+5

Marc Schoenefeld · Published 2024-11-26 · Updated 2025-11-19 · CVE-2024-11706

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 133 Thunderbird versions prior to 133

Description: A null pointer dereference may have occurred in the pk12util tool, specifically in the SEC ASN1DecodeItem Util function, when handling malformed or improperly formatted input files. This issue can potentially allow a remote attacker to cause a denial of service.

Recommendations: For Firefox versions prior to 133, update to a version that includes the fix for this issue. For Thunderbird versions prior to 133, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of the pk12util tool and the SEC ASN1DecodeItem Util function until a patch is available.

Fix

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

ALT-PU-2024-16375

ALT-PU-2025-11100

ALT-PU-2025-14599

ALT-PU-2025-2230

ALT-PU-2025-5137

ALT-PU-2025-7695

BDU:2024-11062

CVE-2024-11706

OPENSUSE-SU-2024:14583-1

USN-7134-1

Affected Products

Alt Linux

Astra Linux

Firefox

Linuxmint

Thunderbird

Ubuntu

References · 53

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11706 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2024-63 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2024-67 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-11708 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-11706 · Security Note
• https://ubuntu.com/security/CVE-2024-11701 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0411SE18 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-11696 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7134-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-11699 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-11706 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11706 · Security Note
• https://ubuntu.com/security/CVE-2024-11706 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2024-63 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2024-67 · Vendor Advisory