PDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle the appending of an IFRAME element, which allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using this element within an embedded PDF object.
CVSS Details
- CVSS 3.1 Base Score: 8.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade firefoxUpgrade linux-firefoxUpgrade seamonkeyUpgrade linux-seamonkeyUpgrade linux-thunderbirdUpgrade thunderbird | Dec 10, 2025 | Oct 30, 2013 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird.Upgrade mail-client/thunderbird-bin.Upgrade www-client/seamonkey.Upgrade www-client/firefox.Upgrade dev-libs/nspr.Upgrade www-client/firefox-bin.Upgrade www-client/seamonkey-bin. | Oct 30, 2017 | Oct 30, 2013 |
| Mfsa2013 99 | — | Upgrade to Mozilla Firefox version 25.0Upgrade to Mozilla Firefox ESR version 24.1Upgrade to the latest version of Mozilla Firefox | Oct 30, 2013 | Oct 29, 2013 |
| Suse | — | Upgrade seamonkeyUpgrade MozillaThunderbird-translations-otherUpgrade mozilla-xulrunner192-gnomeUpgrade firefox-gtk2Upgrade mozilla-xulrunner191-translationsUpgrade mozilla-xulrunner191-gnomevfs-32bitUpgrade firefox-glib2Upgrade firefox-glib2-32bitUpgrade MozillaFirefoxUpgrade mozilla-xulrunner191Upgrade mozilla-nss-toolsUpgrade firefox-pixmanUpgrade mozilla-nss-develUpgrade mozilla-nspr-32bitUpgrade firefox-libstdc++6-32bitUpgrade mozilla-xulrunner191-32bitUpgrade firefox-libstdc++6Upgrade seamonkey-ircUpgrade mozilla-js-32bitUpgrade seamonkey-translations-otherUpgrade firefox-freetype2-32bitUpgrade firefox-fontconfigUpgrade firefox-atk-32bitUpgrade enigmailUpgrade xulrunner-32bitUpgrade mozilla-xulrunner192-translationsUpgrade firefox-cairo-32bitUpgrade mozilla-nss-32bitUpgrade firefox-gtk2-32bitUpgrade firefox-fontconfig-32bitUpgrade xulrunner-develUpgrade MozillaFirefox-translations-otherUpgrade mozilla-xulrunner192-gnome-32bitUpgrade firefox-libgcc_s1-32bitUpgrade firefox-gtk2-langUpgrade mozilla-xulrunner191-translations-32bitUpgrade firefox-pango-32bitUpgrade MozillaThunderbird-develUpgrade MozillaThunderbirdUpgrade mozilla-nsprUpgrade mozillafirefox-branding-upstreamUpgrade seamonkey-translations-commonUpgrade mozilla-xulrunner192-32bitUpgrade firefox-pixman-32bitUpgrade xulrunner-buildsymbolsUpgrade firefox-atkUpgrade firefox-libgcc_s1Upgrade mozilla-xulrunner191-gnomevfsUpgrade firefox-freetype2Upgrade MozillaThunderbird-translations-commonUpgrade mozilla-jsUpgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox-develUpgrade mozillafirefox-buildsymbolsUpgrade MozillaFirefox-translationsUpgrade xulrunnerUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-pcre-32bitUpgrade mozilla-nspr-develUpgrade seamonkey-dom-inspectorUpgrade firefox-pcreUpgrade firefox-pangoUpgrade mozilla-nssUpgrade mozilla-xulrunner192-translations-32bitUpgrade firefox-cairoUpgrade MozillaThunderbird-buildsymbolsUpgrade mozilla-xulrunner192Upgrade seamonkey-venkman | Feb 17, 2015 | Oct 30, 2013 |
| Ubuntu | — | Upgrade firefox | Nov 8, 2024 | Oct 30, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub