CVE-2024-11705: Null Pointer Dereference

Published Nov 26, 2024
·
Updated

NSCDeriveKey inadvertently assumed that the phKey parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior conflicted with the PKCS#11 v3.0 specification, which allows phKey to be NULL for certain mechanisms. This vulnerability affects Firefox < 133 and Thunderbird < 133.

Other sources

NSCDeriveKey inadvertently assumed that the phKey parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior conflicted with the PKCS#11 v3.0 specification, which allows phKey to be NULL for certain mechanisms.

Mozilla

Affected Software

5 affected componentsFixes available
debian/firefox
135.0-1
Mozilla Thunderbird<133
133
Mozilla Firefox<133
133
Mozilla Firefox<133.0
Mozilla Thunderbird<133.0

Event History

Nov 26, 2024
CVE Published
via Mozilla·12:00 AM
CVE Published
via MITRE·01:34 PM
Data Sourced
via MITRE·01:34 PM
DescriptionWeakness
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:15 PM
Affected Software
Dec 7, 2024
Data Sourced
via Ubuntu·04:41 AM
RemedyDescriptionSeverityAffected Software
Feb 6, 2025
Data Sourced
via Debian·07:43 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2024-11705?

CVE-2024-11705 is classified as a security vulnerability that can lead to segmentation faults and application crashes.

2

How do I fix CVE-2024-11705?

To fix CVE-2024-11705, update Mozilla Thunderbird or Mozilla Firefox to version 134 or later.

3

What software is affected by CVE-2024-11705?

CVE-2024-11705 affects Mozilla Thunderbird versions prior to 134 and Mozilla Firefox versions prior to 134.

4

What kind of issue does CVE-2024-11705 cause?

CVE-2024-11705 causes segmentation faults when the phKey parameter is passed as NULL.

5

Does CVE-2024-11705 comply with PKCS#11 v3.0 specifications?

CVE-2024-11705 does not comply with PKCS#11 v3.0 specifications, which allow phKey to be NULL for certain mechanisms.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203