The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade firefox-x11Upgrade thunderbirdUpgrade firefox | Dec 6, 2024 | Nov 26, 2024 |
| Alpine Linux | — | Upgrade thunderbirdUpgrade firefoxUpgrade firefox-esr | Aug 8, 2025 | Nov 26, 2024 |
| Debian | — | Upgrade firefox-esrUpgrade thunderbird | Dec 2, 2024 | Nov 26, 2024 |
| Freebsd | — | Upgrade firefox-esrUpgrade firefoxUpgrade thunderbird | Dec 12, 2024 | Dec 10, 2024 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird.Upgrade www-client/firefox.Upgrade dev-lang/spidermonkey.Upgrade www-client/firefox-bin.Upgrade mail-client/thunderbird-bin. | Jan 24, 2025 | Nov 26, 2024 |
| Mfsa2024 63 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox version 133.0 | Nov 27, 2024 | Nov 26, 2024 |
| Mfsa2024 64 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox ESR version 128.5 | Nov 27, 2024 | Nov 26, 2024 |
| Mozilla Thunderbird | — | Upgrade to the latest version of Mozilla ThunderbirdUpgrade to Mozilla Thunderbird version 128.5 | Nov 27, 2024 | Nov 26, 2024 |
| Oracle_linux | — | Upgrade firefox-x11Upgrade thunderbirdUpgrade firefox | Dec 3, 2024 | Nov 26, 2024 |
| Redhat_linux | — | Upgrade qemu-kvm-ui-egl-headless-debuginfoUpgrade qemu-kvm-ui-dbus-debuginfoUpgrade thunderbird-debuginfoNo solution existsUpgrade qemu-kvm-device-usb-host-debuginfoUpgrade qemu-kvm-coreUpgrade qemu-kvm-device-display-virtio-gpu-ccwUpgrade qemu-pr-helper-debuginfoUpgrade qemu-kvm-docsUpgrade qemu-kvm-block-curlUpgrade qemu-kvm-tools-debuginfoUpgrade thunderbird-debugsourceUpgrade qemu-kvm-core-debuginfoUpgrade qemu-guest-agentUpgrade qemu-kvm-device-display-virtio-vga-debuginfoUpgrade qemu-kvm-block-blkioUpgrade qemu-img-debuginfoUpgrade qemu-kvm-ui-egl-headlessUpgrade qemu-guest-agent-debuginfoUpgrade qemu-kvm-block-rbd-debuginfoUpgrade firefox-debuginfoUpgrade qemu-kvm-audio-pa-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-ccw-debuginfoUpgrade qemu-kvmUpgrade qemu-kvm-debugsourceUpgrade firefox-debugsourceUpgrade qemu-imgUpgrade qemu-kvm-block-rbdUpgrade thunderbirdUpgrade qemu-pr-helperUpgrade qemu-kvm-device-display-virtio-gpu-debuginfoUpgrade qemu-kvm-block-blkio-debuginfoUpgrade qemu-kvm-ui-opengl-debuginfoUpgrade firefox-x11Upgrade qemu-kvm-device-usb-redirect-debuginfoUpgrade qemu-kvm-device-usb-redirectUpgrade qemu-kvm-commonUpgrade qemu-kvm-block-curl-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-pci-debuginfoUpgrade qemu-kvm-device-display-virtio-gpuUpgrade firefoxUpgrade qemu-kvm-common-debuginfoUpgrade qemu-kvm-ui-openglUpgrade qemu-kvm-device-display-virtio-vgaUpgrade qemu-kvm-tests-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-pciUpgrade qemu-kvm-audio-dbus-debuginfoUpgrade qemu-kvm-device-usb-hostUpgrade qemu-kvm-audio-paUpgrade qemu-kvm-tools | Feb 10, 2025 | Nov 26, 2024 |
| Rocky_linux | — | Upgrade qemu-kvm-audio-paUpgrade qemu-kvm-common-debuginfoUpgrade qemu-kvm-commonUpgrade qemu-kvm-block-curl-debuginfoUpgrade qemu-kvm-device-usb-host-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-pci-debuginfoUpgrade qemu-kvm-device-display-virtio-gpuUpgrade firefox-debuginfoUpgrade qemu-kvm-block-blkio-debuginfoUpgrade qemu-kvm-ui-opengl-debuginfoUpgrade qemu-kvm-device-usb-redirect-debuginfoUpgrade qemu-kvm-block-rbd-debuginfoUpgrade thunderbird-debugsourceUpgrade qemu-kvm-device-display-virtio-gpu-ccw-debuginfoUpgrade firefoxUpgrade qemu-kvm-device-display-virtio-gpu-debuginfoUpgrade qemu-kvm-docsUpgrade qemu-guest-agentUpgrade qemu-kvm-block-curlUpgrade qemu-pr-helperUpgrade thunderbird-debuginfoUpgrade thunderbirdUpgrade qemu-img-debuginfoUpgrade qemu-kvm-device-display-virtio-vga-debuginfoUpgrade qemu-kvm-ui-openglUpgrade firefox-debugsourceUpgrade qemu-kvm-debugsourceUpgrade qemu-kvm-coreUpgrade qemu-kvm-block-rbdUpgrade qemu-kvm-audio-pa-debuginfoUpgrade qemu-kvm-core-debuginfoUpgrade qemu-kvm-device-usb-hostUpgrade qemu-kvm-device-display-virtio-gpu-pciUpgrade qemu-guest-agent-debuginfoUpgrade qemu-kvm-device-usb-redirectUpgrade qemu-pr-helper-debuginfoUpgrade qemu-kvm-ui-egl-headlessUpgrade qemu-kvm-device-display-virtio-vgaUpgrade qemu-imgUpgrade qemu-kvm-ui-egl-headless-debuginfoUpgrade qemu-kvm-toolsUpgrade qemu-kvm-block-blkioUpgrade qemu-kvmUpgrade qemu-kvm-tools-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-ccw | Feb 5, 2026 | Dec 19, 2024 |
| Suse | — | Upgrade mozillafirefox-branding-upstreamUpgrade MozillaFirefox-translations-commonUpgrade MozillaFirefoxUpgrade libmozjs-128-0Upgrade mozjs128-develUpgrade MozillaFirefox-develUpgrade mozjs128Upgrade MozillaThunderbirdUpgrade MozillaThunderbird-translations-commonUpgrade MozillaThunderbird-translations-otherUpgrade MozillaFirefox-translations-other | Jan 3, 2025 | Nov 26, 2024 |
| Ubuntu | — | Upgrade firefox | Dec 4, 2024 | Nov 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub