CVE-2024-4367: falha de média gravidade em Mozilla Firefox
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
60Vexday Risk Score
Acompanhe. Ela tem prova de conceito pública.
ssvc Attendcvss 5.6epss 71%
da publicação à arma6 dias
Publicada no NVD14 de mai.
1ª PoC+6d
O que os fabricantes declaram (VEX)
Declarações oficiais dos fabricantes em formato CSAF/VEX: se o produto deles está afetado, já corrigido ou descartado — e por quê. É afirmação do fabricante, não juízo do Vexday.
Red Hatdocumento VEX ↗
Afetado
2 produtos (10 componentes)
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7
no_fix_planned: Out of support scope
Corrigido
26 produtos (605 componentes)
Red Hat Enterprise Linux AppStream (v. 9) · Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream E4S (v.9.2) · Red Hat Enterprise Linux AppStream E4S (v.9.4) · Red Hat Enterprise Linux AppStream EUS (v.9.6) · e outros 21
Não afetado
1 produto (4 componentes) — porque o código vulnerável não está presente no produto
Red Hat Enterprise Linux 6
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
PoCs públicas encontradas — 33
cve_referencewww.exploit-db.com/exploits/52273não verificadogithubgithub.com/LOURC0D3/CVE-2024-4367-PoC★ 203githubgithub.com/s4vvysec/CVE-2024-4367-POC★ 58githubgithub.com/Zombie-Kaiser/cve-2024-4367-PoC-fixed★ 12githubgithub.com/spaceraccoon/detect-cve-2024-4367★ 11githubgithub.com/snyk-labs/pdfjs-vuln-demo★ 10githubgithub.com/UnHackerEnCapital/PDFernetRemotelo★ 6githubgithub.com/Masamuneee/CVE-2024-4367-Analysis★ 5githubgithub.com/clarkio/pdfjs-vuln-demo★ 4githubgithub.com/exfil0/WEAPONIZING-CVE-2024-4367★ 3githubgithub.com/AnomalousVectors/cve-2024-4367-poc★ 2githubgithub.com/1337rokudenashi/Odoo_PDFjs_CVE-2024-4367.pdf★ 2githubgithub.com/avalahEE/pdfjs_disable_eval★ 1githubgithub.com/kabiri-labs/CVE-2024-4367-PoC★ 1githubgithub.com/veronimo669/pdf.js-CVE-2024-4367★ 1githubgithub.com/elamani-drawing/CVE-2024-4367-POC-PDFJS★ 1githubgithub.com/pS3ud0RAnD0m/cve-2024-4367-poc★ 1githubgithub.com/VVeakee/CVE-2024-4367★ 0githubgithub.com/pedrochalegre7/CVE-2024-4367-pdf-sample★ 0githubgithub.com/PenguinCabinet/CVE-2024-4367-hands-on★ 0githubgithub.com/yuimamur/CVE-2024-4367-hands-on-01★ 0githubgithub.com/weae26/cve-2024-4367-poc★ 0githubgithub.com/lewiskb/Docker-Lab-CVE-2024-4367★ 0githubgithub.com/weae26/aia-pdfjs-poc★ 0githubgithub.com/m0d0ri205/PDFJS★ 0githubgithub.com/BektiHandoyo/cve-pdf-host★ 0githubgithub.com/Bhavyakcwestern/Hacking-pdf.js-vulnerability★ 0githubgithub.com/xiaoqiesec0x1/CVE-2024-4367-PDF.js-xss★ 0githubgithub.com/yuimamur/CVE-2024-4367-hands-on★ 0githubgithub.com/stuara1/cpc-pdfjs-poc★ 0githubgithub.com/DharmarajPS/pdfjs-cve-2024-4367-poc★ 0githubgithub.com/0xr2r/CVE-2024-4367★ 0githubgithub.com/J1nKsC/CVE-2024-4367_test★ 0⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Mozilla Firefox
No mesmo produto, das mais perigosas para as menos.
Referências
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645https://cert-portal.siemens.com/productcert/html/ssa-827383.htmlhttps://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/http://seclists.org/fulldisclosure/2024/Aug/30https://github.com/gogs/gogs/issues/7928https://github.com/mozilla/pdf.js/releases/tag/v4.2.67https://lists.debian.org/debian-lts-announce/2024/05/msg00010.htmlhttps://lists.debian.org/debian-lts-announce/2024/05/msg00012.htmlhttps://www.exploit-db.com/exploits/52273https://www.mozilla.org/security/advisories/mfsa2024-21/https://www.mozilla.org/security/advisories/mfsa2024-22/https://www.mozilla.org/security/advisories/mfsa2024-23/