CVE-2024-11705: Null Pointer Dereference
NSCDeriveKey inadvertently assumed that the phKey parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior conflicted with the PKCS#11 v3.0 specification, which allows phKey to be NULL for certain mechanisms. This vulnerability affects Firefox < 133 and Thunderbird < 133.
Other sources
NSCDeriveKey inadvertently assumed that the phKey parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior conflicted with the PKCS#11 v3.0 specification, which allows phKey to be NULL for certain mechanisms.
— Mozilla
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-11705?
CVE-2024-11705 is classified as a security vulnerability that can lead to segmentation faults and application crashes.
How do I fix CVE-2024-11705?
To fix CVE-2024-11705, update Mozilla Thunderbird or Mozilla Firefox to version 134 or later.
What software is affected by CVE-2024-11705?
CVE-2024-11705 affects Mozilla Thunderbird versions prior to 134 and Mozilla Firefox versions prior to 134.
What kind of issue does CVE-2024-11705 cause?
CVE-2024-11705 causes segmentation faults when the phKey parameter is passed as NULL.
Does CVE-2024-11705 comply with PKCS#11 v3.0 specifications?
CVE-2024-11705 does not comply with PKCS#11 v3.0 specifications, which allow phKey to be NULL for certain mechanisms.