CVE-2024-3863: Malicious File Upload
The executable file warning was not presented when downloading .xrm-ms files. Note: This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
Other sources
The executable file warning was not presented when downloading .xrm-ms files. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.10 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 125 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.10
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-3863?
CVE-2024-3863 is classified as a medium severity vulnerability due to the potential for executing malicious files without warning.
How do I fix CVE-2024-3863?
To fix CVE-2024-3863, update your Firefox or Thunderbird to version 125 or 115.10 respectively, as these versions contain the necessary security patches.
Which products are affected by CVE-2024-3863?
CVE-2024-3863 affects Firefox versions below 125, Firefox ESR versions below 115.10, and Thunderbird versions below 115.10.
Is my operating system affected by CVE-2024-3863?
CVE-2024-3863 only affects Windows operating systems; other operating systems remain unaffected.
What type of files are associated with CVE-2024-3863?
CVE-2024-3863 is specifically associated with the downloading of .xrm-ms files, which may be executable.