{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-11696", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2024-11-25T16:29:33.470Z", "datePublished": "2024-11-26T13:33:59.172Z", "dateUpdated": "2025-11-03T21:52:00.429Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"lessThan": "133", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Firefox ESR", "vendor": "Mozilla", "versions": [{"lessThan": "128.5", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThan": "133", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThan": "128.5", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5."}]}], "problemTypes": [{"descriptions": [{"description": "Unhandled Exception in Add-on Signature Verification", "lang": "en", "type": "text"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1929600"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-63/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-64/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-67/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-68/"}], "credits": [{"lang": "en", "value": "Rob Wu"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2024-11-26T13:33:59.172Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-347", "lang": "en", "description": "CWE-347 Improper Verification of Cryptographic Signature"}]}], "affected": [{"vendor": "mozilla", "product": "firefox", "cpes": ["cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "133", "versionType": "custom"}]}, {"vendor": "mozilla", "product": "firefox_esr", "cpes": ["cpe:2.3:a:mozilla:firefox_esr:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "128.5", "versionType": "custom"}]}, {"vendor": "mozilla", "product": "thunderbird", "cpes": ["cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "133", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "128.5", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-12-02T17:02:13.730343Z", "id": "CVE-2024-11696", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-02T17:09:14.835Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00029.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:52:00.429Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00029.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:52:00.429Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-11696", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-02T17:02:13.730343Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*"], "vendor": "mozilla", "product": "firefox", "versions": [{"status": "affected", "version": "0", "lessThan": "133", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:mozilla:firefox_esr:-:*:*:*:*:*:*:*"], "vendor": "mozilla", "product": "firefox_esr", "versions": [{"status": "affected", "version": "0", "lessThan": "128.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:*"], "vendor": "mozilla", "product": "thunderbird", "versions": [{"status": "affected", "version": "0", "lessThan": "133", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "128.5", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-02T17:09:05.921Z"}}], "cna": {"credits": [{"lang": "en", "value": "Rob Wu"}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "133", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "128.5", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "133", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "128.5", "versionType": "custom"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1929600"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-63/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-64/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-67/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-68/"}], "descriptions": [{"lang": "en", "value": "The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.", "supportingMedia": [{"type": "text/html", "value": "The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Unhandled Exception in Add-on Signature Verification"}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2024-11-26T13:33:59.172Z"}}}, "cveMetadata": {"cveId": "CVE-2024-11696", "state": "PUBLISHED", "dateUpdated": "2025-11-03T21:52:00.429Z", "dateReserved": "2024-11-25T16:29:33.470Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2024-11-26T13:33:59.172Z", "assignerShortName": "mozilla"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "matchCriteriaId": "883C5169-FA69-4478-BE73-4F36AB746D39", "versionEndExcluding": "128.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "matchCriteriaId": "B0358306-5BCC-49DE-B7A5-429C8BC71BBA", "versionEndExcluding": "133.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "9C047DD2-FCBA-4474-8AAE-DBB9A5142E4F", "versionEndExcluding": "128.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "809C8F59-3AAB-49E8-9F18-6884EC6E4E92", "versionEndExcluding": "133.0", "versionStartIncluding": "129.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5."}, {"lang": "es", "value": "La aplicaci\u00f3n no tuvo en cuenta las excepciones generadas por el m\u00e9todo `loadManifestFromFile` durante la verificaci\u00f3n de la firma del complemento. Esta falla, provocada por un manifiesto de extensi\u00f3n no v\u00e1lido o no compatible, podr\u00eda haber causado errores de tiempo de ejecuci\u00f3n que interrumpieron el proceso de validaci\u00f3n de la firma. Como resultado, es posible que se haya omitido la aplicaci\u00f3n de la validaci\u00f3n de la firma para complementos no relacionados. La validaci\u00f3n de la firma en este contexto se utiliza para garantizar que las aplicaciones de terceros en la computadora del usuario no hayan alterado las extensiones del usuario, lo que limita el impacto de este problema. Esta vulnerabilidad afecta a Firefox &lt; 133, Firefox ESR &lt; 128.5, Thunderbird &lt; 133 y Thunderbird &lt; 128.5."}], "id": "CVE-2024-11696", "lastModified": "2025-11-03T22:16:38.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-11-26T14:15:19.143", "references": [{"source": "security@mozilla.org", "tags": ["Issue Tracking"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1929600"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2024-63/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2024-64/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2024-67/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2024-68/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00029.html"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2024:10881", "cpe": "cpe:/o:redhat:rhel_els:7", "package": "firefox-0:128.5.1-1.el7_9", "product_name": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "release_date": "2024-12-09T00:00:00Z"}, {"advisory": "RHSA-2024:10591", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:128.5.0-1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-12-02T00:00:00Z"}, {"advisory": "RHSA-2024:10752", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:128.5.1-1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-12-03T00:00:00Z"}, {"advisory": "RHSA-2024:10704", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "thunderbird-0:128.5.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2024-12-02T00:00:00Z"}, {"advisory": "RHSA-2024:10844", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "firefox-0:128.5.1-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2024-12-05T00:00:00Z"}, {"advisory": "RHSA-2024:10733", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "thunderbird-0:128.5.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2024-12-03T00:00:00Z"}, {"advisory": "RHSA-2024:10849", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "firefox-0:128.5.1-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2024-12-05T00:00:00Z"}, {"advisory": "RHSA-2024:10733", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "thunderbird-0:128.5.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2024-12-03T00:00:00Z"}, {"advisory": "RHSA-2024:10849", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "firefox-0:128.5.1-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2024-12-05T00:00:00Z"}, {"advisory": "RHSA-2024:10733", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "thunderbird-0:128.5.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2024-12-03T00:00:00Z"}, {"advisory": "RHSA-2024:10849", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "firefox-0:128.5.1-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2024-12-05T00:00:00Z"}, {"advisory": "RHSA-2024:10734", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "thunderbird-0:128.5.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2024-12-03T00:00:00Z"}, {"advisory": "RHSA-2024:10880", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "firefox-0:128.5.1-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2024-12-09T00:00:00Z"}, {"advisory": "RHSA-2024:10734", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "thunderbird-0:128.5.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2024-12-03T00:00:00Z"}, {"advisory": "RHSA-2024:10880", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "firefox-0:128.5.1-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2024-12-09T00:00:00Z"}, {"advisory": "RHSA-2024:10734", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "thunderbird-0:128.5.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2024-12-03T00:00:00Z"}, {"advisory": "RHSA-2024:10880", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "firefox-0:128.5.1-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2024-12-09T00:00:00Z"}, {"advisory": "RHSA-2024:10710", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "thunderbird-0:128.5.0-1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-12-02T00:00:00Z"}, {"advisory": "RHSA-2024:10848", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "firefox-0:128.5.1-1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-12-05T00:00:00Z"}, {"advisory": "RHSA-2024:10592", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "thunderbird-0:128.5.0-1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-12-02T00:00:00Z"}, {"advisory": "RHSA-2024:10702", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "firefox-0:128.5.1-1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-12-02T00:00:00Z"}, {"advisory": "RHSA-2024:10703", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "thunderbird-0:128.5.0-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2024-12-02T00:00:00Z"}, {"advisory": "RHSA-2024:10743", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "firefox-0:128.5.1-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2024-12-03T00:00:00Z"}, {"advisory": "RHSA-2024:10667", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "thunderbird-0:128.5.0-1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-12-02T00:00:00Z"}, {"advisory": "RHSA-2024:10745", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "firefox-0:128.5.1-1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-12-03T00:00:00Z"}, {"advisory": "RHSA-2024:10742", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "firefox-0:128.5.1-1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2024-12-03T00:00:00Z"}, {"advisory": "RHSA-2024:10748", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "thunderbird-0:128.5.0-1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2024-12-03T00:00:00Z"}], "bugzilla": {"description": "firefox: thunderbird: Unhandled Exception in Add-on Signature Verification", "id": "2328943", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2328943"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "status": "verified"}, "cwe": "CWE-354", "details": ["The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.", "The Mozilla Foundation's Security Advisory: The application can fail to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw is triggered by an invalid or unsupported extension manifest and could cause runtime errors that disrupt the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may be bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue."], "name": "CVE-2024-11696", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "firefox-flatpak-container", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "thunderbird-flatpak-container", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-11-26T13:33:59Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-11696\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-11696\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1929600\nhttps://www.mozilla.org/security/advisories/mfsa2024-63/\nhttps://www.mozilla.org/security/advisories/mfsa2024-64/\nhttps://www.mozilla.org/security/advisories/mfsa2024-67/\nhttps://www.mozilla.org/security/advisories/mfsa2024-68/"], "statement": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", "threat_severity": "Moderate"}

{}