CVE-2024-4367
Assigner: mozilla
Published: 2024-05-14T17:21:23.486Z
State: PUBLISHED
affected: product: Firefox
vendor: Mozilla
versions: lessThan: 126
status: affected
version: unspecified
versionType: custom
product: Firefox ESR
vendor: Mozilla
versions: lessThan: 115.11
status: affected
version: unspecified
versionType: custom
product: Thunderbird
vendor: Mozilla
versions: lessThan: 115.11
status: affected
version: unspecified
versionType: custom
descriptions: value: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
supportingMedia: type: text/html
base64: no
value: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
problemTypes: descriptions: description: Arbitrary JavaScript execution in PDF.js
type: text
credits: value: Thomas Rinsma of Codean Labs