CVE-2024-4367

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

Affected products

Alt Linux, Almalinux, Astra Linux, Centos, Confluence, Firefox, Firefox Esr, Linuxmint

Mozilla Firefox

< 115.11.0, 126.0

Mozilla Thunderbird

< 115.11.0

Fix

Available

CVSS 3.1

8.8 HIGH

EPSS

70.7% (99th percentile)

Weakness

CWE-754

NVD status

Modified

Published

2024-05-14