A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| 3d Flipbook Dflip Lite Plugin | — | Update 3d-flipbook-dflip-lite plugin to version 1.15.6, or a newer patched version | May 15, 2025 | May 20, 2024 |
| Alma_linux | — | Upgrade webkit2gtk3-develUpgrade webkit2gtk3Upgrade firefoxUpgrade webkit2gtk3-jscUpgrade webkit2gtk3-jsc-develUpgrade firefox-x11Upgrade thunderbird | May 22, 2024 | May 14, 2024 |
| Amazon Linux Ami 2 | — | Upgrade thunderbirdUpgrade firefox-debuginfoUpgrade thunderbird-debuginfoUpgrade firefox | Jun 12, 2024 | May 14, 2024 |
| Ari Fancy Lightbox Plugin | — | Update ari-fancy-lightbox plugin to version 1.3.15, or a newer patched version | May 15, 2025 | May 20, 2024 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Mar 19, 2025 | Mar 18, 2025 |
| Bsk Pdf Manager Plugin | — | Update bsk-pdf-manager plugin to version 3.6.1, or a newer patched version | May 15, 2025 | May 20, 2024 |
| Centos_linux | — | Upgrade firefox-debuginfoUpgrade thunderbird-debuginfoUpgrade firefoxUpgrade thunderbird | May 17, 2024 | May 14, 2024 |
| Debian | — | Upgrade firefox-esrUpgrade webkit2gtkUpgrade thunderbirdUpgrade odoo | May 17, 2024 | May 14, 2024 |
| Embedpress Plugin | — | Update embedpress plugin to version 4.0.3, or a newer patched version | May 15, 2025 | May 20, 2024 |
| Freebsd | — | Upgrade gitlab-eeUpgrade gitlab-ce | May 23, 2024 | May 22, 2024 |
| Mfsa2024 21 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox version 126.0 | May 15, 2024 | May 14, 2024 |
| Mfsa2024 22 | — | Upgrade to Mozilla Firefox ESR version 115.11Upgrade to the latest version of Mozilla Firefox | May 15, 2024 | May 14, 2024 |
| Mozilla Thunderbird | — | Upgrade to the latest version of Mozilla ThunderbirdUpgrade to Mozilla Thunderbird version 115.11 | May 15, 2024 | May 15, 2024 |
| Oracle_linux | — | Upgrade thunderbirdUpgrade firefoxUpgrade firefox-x11 | May 17, 2024 | May 14, 2024 |
| Pdf Embedder Plugin | — | Update pdf-embedder plugin to version 4.8.0, or a newer patched version | May 15, 2025 | May 20, 2024 |
| Pdf Poster Plugin | — | Update pdf-poster plugin to version 2.1.22, or a newer patched version | May 15, 2025 | May 20, 2024 |
| Pdfjs Viewer Shortcode Plugin | — | Update pdfjs-viewer-shortcode plugin to version 2.2, or a newer patched version | May 15, 2025 | May 20, 2024 |
| Redhat_linux | — | Upgrade webkit2gtk3Upgrade webkitgtk4Upgrade thunderbirdNo solution existsUpgrade webkitgtk4-docUpgrade thunderbird-debuginfoUpgrade webkit2gtk3-devel-debuginfoUpgrade firefox-x11Upgrade webkit2gtk3-debugsourceUpgrade firefoxUpgrade webkit2gtk3-jscUpgrade webkit2gtk3-jsc-develUpgrade webkit2gtk3-debuginfoUpgrade webkitgtk4-jscUpgrade webkit2gtk3-jsc-devel-debuginfoUpgrade webkitgtk4-develUpgrade firefox-debugsourceUpgrade thunderbird-debugsourceUpgrade webkitgtk4-debuginfoUpgrade webkit2gtk3-jsc-debuginfoUpgrade webkitgtk4-jsc-develUpgrade firefox-debuginfoUpgrade webkit2gtk3-devel | May 17, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade webkit2gtk3-develUpgrade thunderbird-debuginfoUpgrade firefox-debugsourceUpgrade webkit2gtk3-debugsourceUpgrade firefox-debuginfoUpgrade webkit2gtk3Upgrade webkit2gtk3-jsc-debuginfoUpgrade webkit2gtk3-debuginfoUpgrade thunderbird-debugsourceUpgrade webkit2gtk3-jscUpgrade webkit2gtk3-jsc-devel-debuginfoUpgrade firefoxUpgrade thunderbirdUpgrade webkit2gtk3-jsc-develUpgrade webkit2gtk3-devel-debuginfo | Jun 17, 2024 | May 14, 2024 |
| Suse | — | Upgrade MozillaFirefox-translations-otherUpgrade MozillaFirefoxUpgrade MozillaFirefox-translations-commonUpgrade MozillaThunderbird-translations-commonUpgrade MozillaFirefox-develUpgrade mozillafirefox-branding-upstreamUpgrade MozillaThunderbird-translations-otherUpgrade MozillaThunderbird | May 20, 2024 | May 14, 2024 |
| Tainacan Plugin | — | Update tainacan plugin to version 0.21.6, or a newer patched version | May 15, 2025 | May 20, 2024 |
| Ubuntu | — | Upgrade firefoxUpgrade thunderbird | May 28, 2024 | May 14, 2024 |
| Wonderplugin Pdf Embed Plugin | — | Update wonderplugin-pdf-embed plugin to version 2.8, or a newer patched version | May 15, 2025 | May 20, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub