The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade thunderbirdUpgrade firefoxUpgrade firefox-x11 | Dec 6, 2024 | Nov 26, 2024 |
| Alpine Linux | — | Upgrade firefox-esrUpgrade firefoxUpgrade thunderbird | Aug 8, 2025 | Nov 26, 2024 |
| Debian | — | Upgrade firefox-esrUpgrade thunderbird | Dec 2, 2024 | Nov 26, 2024 |
| Freebsd | — | Upgrade firefox-esrUpgrade thunderbirdUpgrade firefox | Dec 12, 2024 | Dec 10, 2024 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird.Upgrade dev-lang/spidermonkey.Upgrade www-client/firefox.Upgrade www-client/firefox-bin.Upgrade mail-client/thunderbird-bin. | Jan 24, 2025 | Nov 26, 2024 |
| Mfsa2024 63 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox version 133.0 | Nov 27, 2024 | Nov 26, 2024 |
| Mfsa2024 64 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox ESR version 128.5 | Nov 27, 2024 | Nov 26, 2024 |
| Mozilla Thunderbird | — | Upgrade to the latest version of Mozilla ThunderbirdUpgrade to Mozilla Thunderbird version 128.5 | Nov 27, 2024 | Nov 26, 2024 |
| Oracle_linux | — | Upgrade firefox-x11Upgrade firefoxUpgrade thunderbird | Dec 3, 2024 | Nov 26, 2024 |
| Redhat_linux | — | Upgrade qemu-kvm-ui-egl-headless-debuginfoUpgrade qemu-kvm-ui-dbus-debuginfoUpgrade qemu-kvm-device-usb-host-debuginfoNo solution existsUpgrade qemu-guest-agentUpgrade qemu-kvm-block-curlUpgrade qemu-kvm-device-display-virtio-vga-debuginfoUpgrade qemu-kvmUpgrade thunderbird-debugsourceUpgrade qemu-kvm-debugsourceUpgrade qemu-pr-helper-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-ccw-debuginfoUpgrade thunderbird-debuginfoUpgrade qemu-guest-agent-debuginfoUpgrade qemu-img-debuginfoUpgrade firefox-debugsourceUpgrade qemu-kvm-tools-debuginfoUpgrade qemu-kvm-audio-pa-debuginfoUpgrade qemu-kvm-docsUpgrade qemu-kvm-block-blkioUpgrade qemu-kvm-ui-egl-headlessUpgrade qemu-imgUpgrade qemu-kvm-core-debuginfoUpgrade qemu-kvm-block-rbd-debuginfoUpgrade qemu-kvm-coreUpgrade qemu-kvm-device-display-virtio-gpu-ccwUpgrade firefox-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-pciUpgrade qemu-kvm-device-display-virtio-vgaUpgrade qemu-kvm-device-usb-redirect-debuginfoUpgrade qemu-kvm-device-display-virtio-gpuUpgrade qemu-kvm-audio-dbus-debuginfoUpgrade qemu-kvm-block-blkio-debuginfoUpgrade firefoxUpgrade qemu-kvm-toolsUpgrade qemu-kvm-ui-openglUpgrade qemu-kvm-device-usb-hostUpgrade qemu-kvm-device-usb-redirectUpgrade qemu-kvm-device-display-virtio-gpu-pci-debuginfoUpgrade qemu-kvm-commonUpgrade qemu-kvm-block-curl-debuginfoUpgrade qemu-pr-helperUpgrade qemu-kvm-audio-paUpgrade qemu-kvm-ui-opengl-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-debuginfoUpgrade qemu-kvm-tests-debuginfoUpgrade thunderbirdUpgrade firefox-x11Upgrade qemu-kvm-block-rbdUpgrade qemu-kvm-common-debuginfo | Feb 10, 2025 | Nov 26, 2024 |
| Rocky_linux | — | Upgrade qemu-pr-helper-debuginfoUpgrade qemu-kvm-debugsourceUpgrade qemu-kvm-tools-debuginfoUpgrade qemu-kvmUpgrade qemu-kvm-device-display-virtio-gpu-ccwUpgrade qemu-kvm-block-blkioUpgrade qemu-kvm-ui-egl-headless-debuginfoUpgrade qemu-imgUpgrade qemu-kvm-device-usb-hostUpgrade qemu-kvm-device-display-virtio-gpu-pciUpgrade qemu-kvm-ui-egl-headlessUpgrade qemu-kvm-device-display-virtio-vgaUpgrade qemu-kvm-audio-pa-debuginfoUpgrade qemu-kvm-ui-openglUpgrade qemu-kvm-block-rbdUpgrade qemu-kvm-device-display-virtio-vga-debuginfoUpgrade qemu-guest-agent-debuginfoUpgrade qemu-kvm-coreUpgrade qemu-kvm-core-debuginfoUpgrade qemu-kvm-toolsUpgrade firefox-debugsourceUpgrade qemu-kvm-device-usb-redirectUpgrade thunderbird-debuginfoUpgrade thunderbirdUpgrade qemu-kvm-device-display-virtio-gpu-ccw-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-pci-debuginfoUpgrade thunderbird-debugsourceUpgrade qemu-kvm-commonUpgrade qemu-kvm-block-curlUpgrade firefoxUpgrade qemu-kvm-block-curl-debuginfoUpgrade firefox-debuginfoUpgrade qemu-kvm-ui-opengl-debuginfoUpgrade qemu-kvm-device-usb-host-debuginfoUpgrade qemu-img-debuginfoUpgrade qemu-guest-agentUpgrade qemu-pr-helperUpgrade qemu-kvm-device-usb-redirect-debuginfoUpgrade qemu-kvm-common-debuginfoUpgrade qemu-kvm-docsUpgrade qemu-kvm-device-display-virtio-gpuUpgrade qemu-kvm-audio-paUpgrade qemu-kvm-device-display-virtio-gpu-debuginfoUpgrade qemu-kvm-block-blkio-debuginfoUpgrade qemu-kvm-block-rbd-debuginfo | Feb 5, 2026 | Dec 19, 2024 |
| Suse | — | Upgrade mozjs128-develUpgrade MozillaThunderbird-translations-otherUpgrade mozjs128Upgrade MozillaFirefox-translations-otherUpgrade MozillaThunderbirdUpgrade MozillaFirefox-develUpgrade MozillaThunderbird-translations-commonUpgrade mozillafirefox-branding-upstreamUpgrade libmozjs-128-0Upgrade MozillaFirefoxUpgrade MozillaFirefox-translations-common | Jan 3, 2025 | Nov 26, 2024 |
| Ubuntu | — | Upgrade firefox | Dec 4, 2024 | Nov 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub