The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade firefoxUpgrade thunderbirdUpgrade firefox-x11 | Dec 6, 2024 | Nov 26, 2024 |
| Alpine Linux | — | Upgrade firefox-esrUpgrade thunderbirdUpgrade firefox | Aug 8, 2025 | Nov 26, 2024 |
| Debian | — | Upgrade thunderbirdUpgrade firefox-esr | Dec 2, 2024 | Nov 26, 2024 |
| Freebsd | — | Upgrade firefoxUpgrade thunderbirdUpgrade firefox-esr | Dec 12, 2024 | Dec 10, 2024 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird.Upgrade dev-lang/spidermonkey.Upgrade www-client/firefox.Upgrade www-client/firefox-bin.Upgrade mail-client/thunderbird-bin. | Jan 24, 2025 | Nov 26, 2024 |
| Mfsa2024 63 | — | Upgrade to Mozilla Firefox version 133.0 | Nov 27, 2024 | Nov 26, 2024 |
| Mfsa2024 64 | — | Upgrade to Mozilla Firefox ESR version 128.5 | Nov 27, 2024 | Nov 26, 2024 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 128.5 | Nov 27, 2024 | Nov 26, 2024 |
| Oracle_linux | — | Upgrade firefoxUpgrade thunderbirdUpgrade firefox-x11 | Dec 3, 2024 | Nov 26, 2024 |
| Redhat_linux | — | Upgrade qemu-kvm-device-usb-redirect-debuginfoUpgrade qemu-kvm-device-usb-redirectUpgrade qemu-kvm-audio-paUpgrade qemu-kvm-toolsUpgrade qemu-pr-helperUpgrade qemu-kvm-block-blkio-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-pciUpgrade qemu-kvm-tests-debuginfoUpgrade firefoxUpgrade qemu-kvm-common-debuginfoUpgrade qemu-kvm-ui-openglUpgrade thunderbirdUpgrade qemu-kvm-commonUpgrade qemu-kvm-device-display-virtio-gpu-pci-debuginfoUpgrade qemu-kvm-block-curl-debuginfoUpgrade qemu-kvm-device-usb-hostUpgrade qemu-kvm-device-display-virtio-vgaUpgrade qemu-kvm-audio-dbus-debuginfoUpgrade qemu-kvm-device-display-virtio-gpuUpgrade firefox-x11Upgrade qemu-kvm-block-rbdUpgrade qemu-kvm-device-display-virtio-gpu-debuginfoUpgrade qemu-kvm-ui-opengl-debuginfoUpgrade qemu-kvm-ui-dbus-debuginfoUpgrade qemu-kvm-device-usb-host-debuginfoUpgrade qemu-kvm-ui-egl-headless-debuginfoUpgrade qemu-kvm-debugsourceUpgrade qemu-kvm-core-debuginfoUpgrade qemu-kvm-block-blkioUpgrade qemu-kvm-device-display-virtio-vga-debuginfoUpgrade qemu-guest-agentUpgrade qemu-kvm-audio-pa-debuginfoUpgrade firefox-debuginfoUpgrade qemu-imgUpgrade qemu-kvm-coreUpgrade qemu-img-debuginfoUpgrade firefox-debugsourceUpgrade thunderbird-debugsourceUpgrade qemu-kvm-block-curlUpgrade qemu-kvm-ui-egl-headlessUpgrade qemu-guest-agent-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-ccwUpgrade qemu-kvm-block-rbd-debuginfoUpgrade qemu-kvm-tools-debuginfoUpgrade qemu-kvmUpgrade qemu-kvm-docsUpgrade qemu-pr-helper-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-ccw-debuginfoUpgrade thunderbird-debuginfoNo solution exists | Feb 10, 2025 | Nov 26, 2024 |
| Rocky_linux | — | Upgrade qemu-pr-helperUpgrade qemu-kvm-audio-paUpgrade qemu-kvm-device-usb-redirect-debuginfoUpgrade qemu-kvm-common-debuginfoUpgrade thunderbirdUpgrade thunderbird-debuginfoUpgrade thunderbird-debugsourceUpgrade firefoxUpgrade qemu-guest-agentUpgrade qemu-kvm-commonUpgrade qemu-kvm-device-display-virtio-gpuUpgrade qemu-kvm-device-display-virtio-gpu-debuginfoUpgrade qemu-kvm-docsUpgrade qemu-kvm-block-curlUpgrade qemu-kvm-block-blkio-debuginfoUpgrade qemu-img-debuginfoUpgrade qemu-kvm-block-rbd-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-pci-debuginfoUpgrade qemu-kvm-device-usb-host-debuginfoUpgrade qemu-kvm-block-curl-debuginfoUpgrade qemu-kvm-ui-opengl-debuginfoUpgrade firefox-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-ccw-debuginfoUpgrade qemu-kvm-core-debuginfoUpgrade qemu-kvm-device-usb-redirectUpgrade qemu-kvm-coreUpgrade qemu-guest-agent-debuginfoUpgrade qemu-pr-helper-debuginfoUpgrade qemu-kvm-block-rbdUpgrade qemu-kvm-toolsUpgrade qemu-kvm-device-display-virtio-vgaUpgrade firefox-debugsourceUpgrade qemu-kvm-ui-egl-headlessUpgrade qemu-kvm-debugsourceUpgrade qemu-kvm-block-blkioUpgrade qemu-kvmUpgrade qemu-kvm-device-display-virtio-gpu-ccwUpgrade qemu-kvm-tools-debuginfoUpgrade qemu-kvm-device-usb-hostUpgrade qemu-imgUpgrade qemu-kvm-ui-egl-headless-debuginfoUpgrade qemu-kvm-ui-openglUpgrade qemu-kvm-device-display-virtio-vga-debuginfoUpgrade qemu-kvm-audio-pa-debuginfoUpgrade qemu-kvm-device-display-virtio-gpu-pci | Feb 5, 2026 | Dec 19, 2024 |
| Suse | — | Upgrade mozillafirefox-branding-upstreamUpgrade libmozjs-128-0Upgrade MozillaFirefox-translations-commonUpgrade MozillaFirefoxUpgrade MozillaThunderbird-translations-commonUpgrade MozillaFirefox-develUpgrade MozillaFirefox-translations-otherUpgrade mozjs128-develUpgrade MozillaThunderbirdUpgrade mozjs128Upgrade MozillaThunderbird-translations-other | Jan 3, 2025 | Nov 26, 2024 |
| Ubuntu | — | Upgrade firefox | Dec 4, 2024 | Nov 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub