A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the `SEC_ASN1DecodeItem_Util` function, when handling malformed or improperly formatted input files. This vulnerability affects Firefox < 133 and Thunderbird < 133.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade firefoxUpgrade thunderbird | Apr 15, 2025 | Apr 13, 2025 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade www-client/firefox-bin.Upgrade mail-client/thunderbird.Upgrade www-client/firefox.Upgrade dev-lang/spidermonkey. | Jan 24, 2025 | Nov 26, 2024 |
| Mfsa2024 63 | — | Upgrade to Mozilla Firefox version 133.0Upgrade to the latest version of Mozilla Firefox | Nov 27, 2024 | Nov 26, 2024 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 133.0Upgrade to the latest version of Mozilla Thunderbird | Nov 27, 2024 | Nov 26, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 26, 2024 |
| Ubuntu | — | Upgrade firefox | Dec 4, 2024 | Nov 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub