CVE-2024-4367: medium-severity vulnerability in Mozilla Firefox
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
60Vexday Risk Score
Keep watching. It has a public proof of concept.
ssvc Attendcvss 5.6epss 71%
from disclosure to weapon6 days
Published on NVDMay 14
1st PoC+6d
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Affected
2 products (10 components)
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7
no_fix_planned: Out of support scope
Fixed
26 products (605 components)
Red Hat Enterprise Linux AppStream (v. 9) · Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream E4S (v.9.2) · Red Hat Enterprise Linux AppStream E4S (v.9.4) · Red Hat Enterprise Linux AppStream EUS (v.9.6) · and others 21
Not affected
1 product (4 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 6
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
public PoCs found — 35
cve_referencewww.exploit-db.com/exploits/52273unverifiedgithubgithub.com/LOURC0D3/CVE-2024-4367-PoC★ 202githubgithub.com/s4vvysec/CVE-2024-4367-POC★ 57githubgithub.com/Zombie-Kaiser/cve-2024-4367-PoC-fixed★ 12githubgithub.com/spaceraccoon/detect-cve-2024-4367★ 11githubgithub.com/snyk-labs/pdfjs-vuln-demo★ 10githubgithub.com/UnHackerEnCapital/PDFernetRemotelo★ 6githubgithub.com/Masamuneee/CVE-2024-4367-Analysis★ 5githubgithub.com/clarkio/pdfjs-vuln-demo★ 4githubgithub.com/exfil0/WEAPONIZING-CVE-2024-4367★ 3githubgithub.com/AnomalousVectors/cve-2024-4367-poc★ 2githubgithub.com/pS3ud0RAnD0m/cve-2024-4367-poc★ 1githubgithub.com/elamani-drawing/CVE-2024-4367-POC-PDFJS★ 1githubgithub.com/kabiri-labs/CVE-2024-4367-PoC★ 1githubgithub.com/avalahEE/pdfjs_disable_eval★ 1githubgithub.com/veronimo669/pdf.js-CVE-2024-4367★ 1githubgithub.com/1337rokudenashi/Odoo_PDFjs_CVE-2024-4367.pdf★ 1githubgithub.com/J1nKsC/CVE-2024-4367_test★ 0githubgithub.com/remiBoudreau/CVE-2024-4367★ 0githubgithub.com/pedrochalegre7/CVE-2024-4367-pdf-sample★ 0githubgithub.com/PenguinCabinet/CVE-2024-4367-hands-on★ 0githubgithub.com/yuimamur/CVE-2024-4367-hands-on-01★ 0githubgithub.com/weae26/cve-2024-4367-poc★ 0githubgithub.com/lewiskb/Docker-Lab-CVE-2024-4367★ 0githubgithub.com/weae26/aia-pdfjs-poc★ 0githubgithub.com/m0d0ri205/PDFJS★ 0githubgithub.com/BektiHandoyo/cve-pdf-host★ 0githubgithub.com/Bhavyakcwestern/Hacking-pdf.js-vulnerability★ 0githubgithub.com/xiaoqiesec0x1/CVE-2024-4367-PDF.js-xss★ 0githubgithub.com/yuimamur/CVE-2024-4367-hands-on★ 0githubgithub.com/stuara1/cpc-pdfjs-poc★ 0githubgithub.com/DharmarajPS/pdfjs-cve-2024-4367-poc★ 0githubgithub.com/0xr2r/CVE-2024-4367★ 0githubgithub.com/VVeakee/CVE-2024-4367★ 0githubgithub.com/minhi1/CVE-2024-4367★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Mozilla Firefox
In the same product, most dangerous first.
References
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645https://cert-portal.siemens.com/productcert/html/ssa-827383.htmlhttps://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/http://seclists.org/fulldisclosure/2024/Aug/30https://github.com/gogs/gogs/issues/7928https://github.com/mozilla/pdf.js/releases/tag/v4.2.67https://lists.debian.org/debian-lts-announce/2024/05/msg00010.htmlhttps://lists.debian.org/debian-lts-announce/2024/05/msg00012.htmlhttps://www.exploit-db.com/exploits/52273https://www.mozilla.org/security/advisories/mfsa2024-21/https://www.mozilla.org/security/advisories/mfsa2024-22/https://www.mozilla.org/security/advisories/mfsa2024-23/