CVE-2024-11697: Code Injection
Last updated 3 December 2024
Other sources
When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog. This could have led to malicious code execution.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 135.0-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 128.7.0esr-1~deb11u1Fixed in 128.5.0esr-1~deb12u1Fixed in 128.7.0esr-1~deb12u1Fixed in 128.7.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.7.0esr-1~deb11u1Fixed in 1:128.5.0esr-1~deb12u1Fixed in 1:128.7.0esr-1~deb12u1Fixed in 1:128.6.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 128.5 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 133 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 133 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 128.5 - Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 133 - Upgrade
Upgrade
Mozilla Firefox ESRto a version that resolves this vulnerability.Fixed in 128.5 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 133 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 128.5
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-11697?
CVE-2024-11697 is rated as a high severity vulnerability due to its potential to allow malicious code execution.
How do I fix CVE-2024-11697?
To fix CVE-2024-11697, users should upgrade to the latest versions of Mozilla Thunderbird or Firefox, specifically versions above 133 or 128.6.0esr for Firefox ESR.
What are the affected products for CVE-2024-11697?
CVE-2024-11697 affects Mozilla Thunderbird and Firefox versions up to 133 and Firefox ESR and Thunderbird ESR versions up to 128.5.
What type of attack does CVE-2024-11697 enable?
CVE-2024-11697 enables attackers to trick users into bypassing the 'Open Executable File?' confirmation dialog, potentially leading to code execution.
Is there a workaround for CVE-2024-11697?
There are no documented workarounds for CVE-2024-11697; updating to the patched software versions is recommended.