CVE-2024-11696: Medium severity Mozilla Thunderbird vulnerability
Last updated 3 December 2024
Other sources
The application failed to account for exceptions thrown by the loadManifestFromFile method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.
— MITRE
The application failed to account for exceptions thrown by the loadManifestFromFile method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 135.0-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 128.7.0esr-1~deb11u1Fixed in 128.5.0esr-1~deb12u1Fixed in 128.7.0esr-1~deb12u1Fixed in 128.7.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.7.0esr-1~deb11u1Fixed in 1:128.5.0esr-1~deb12u1Fixed in 1:128.7.0esr-1~deb12u1Fixed in 1:128.6.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 133 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 128.5 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 133 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 128.5 - Upgrade
Upgrade
Thunderbird ESRto a version that resolves this vulnerability.Fixed in 128.5
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-11696?
CVE-2024-11696 is classified as a moderate severity vulnerability due to the potential for runtime errors impacting signature validation.
How do I fix CVE-2024-11696?
To fix CVE-2024-11696, users should update to Mozilla Thunderbird version 134 or higher, Firefox version 134 or higher, or the latest version of Firefox ESR or Thunderbird ESR.
What causes the CVE-2024-11696 vulnerability?
CVE-2024-11696 is caused by the application's failure to properly handle exceptions in the `loadManifestFromFile` method during add-on signature verification.
Which versions of Mozilla software are affected by CVE-2024-11696?
CVE-2024-11696 affects Mozilla Thunderbird versions up to 133, Firefox versions up to 133, and Firefox ESR up to 128.5.
Is there a workaround for CVE-2024-11696?
There is no official workaround for CVE-2024-11696; the recommended action is to upgrade to the fixed software versions.