CVE-2024-4367: Stored XSS via PDFjs

Published May 7, 2024
·
Updated

Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Patches The patch removes the use of eval: https://github.com/mozilla/pdf.js/pull/18015

Workarounds Set the option isEvalSupported to false.

References https://bugzilla.mozilla.org/showbug.cgi?id=1893645

Other sources

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.

— Mozilla

Mitigations were made to take care of vulnerability in PDF.js CVE-2024-4367.

— GitLab

Affected Software

74 affected componentsFixes available
IBM Cognos Analytics<=12.0.0-12.0.3
IBM Cognos Analytics<=11.2.0-11.2.4 FP4
Mozilla Thunderbird<115.11
115.11
Mozilla Firefox ESR<115.11
115.11
npm/pdfjs-dist<=4.1.392
4.2.67
Mozilla Firefox<115.11.0
Mozilla Firefox<126.0
Mozilla Thunderbird<115.11.0
Debian Debian Linux=10.0
Open-Xchange Open-xchange Appsuite Frontend<7.10.6
Open-Xchange Open-xchange Appsuite Frontend=7.10.6
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision10
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision11
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision12
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision13
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision14
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision15
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision16
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision17
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision18
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision19
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision20
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision21
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision22
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision23
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision24
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision25
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision26
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision27
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision28
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision29
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision3
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision30
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision31
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision32
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision33
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision34
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision35
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision36
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision37
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision38
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision39
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision4
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision40
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision41
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision42
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision43
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision44
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision5
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision6
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision7
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision8
Open-Xchange Open-xchange Appsuite Frontend=7.10.6-revision9
redhat/firefox<115.11
115.11
redhat/thunderbird<115.11
115.11
debian/firefox-esr<115.11.0esr-1~deb12u1
115.11.0esr-1~deb12u1
debian/firefox-esr<115.11.0esr-1
115.11.0esr-1
debian/firefox-esr<115.11.0esr-1
115.11.0esr-1
debian/thunderbird<1:115.11.0-1~deb12u1
1:115.11.0-1~deb12u1
debian/thunderbird<1:115.11.0-1
1:115.11.0-1
debian/thunderbird<1:115.11.0-1
1:115.11.0-1
debian/webkit2gtk*
debian/webkit2gtk<2.52.5-1~deb13u1
2.52.5-1~deb13u1
debian/webkit2gtk<2.52.5-1
2.52.5-1
debian/wpewebkit*
debian/wpewebkit*
debian/wpewebkit<2.52.5-1
2.52.5-1
debian/firefox
159.0-1
debian/firefox-esr
140.12.0esr-1~deb12u1153.6.0esr-1~deb12u2140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.6.0esr-1
debian/odoo
19.0.0+dfsg-1
debian/thunderbird
1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u21:140.12.0esr-1~deb13u11:153.6.0esr-1~deb13u11:153.5.0esr-11:153.6.0esr-1
debian/webkit2gtk<=2.50.6-1~deb12u2, <=2.50.6-1~deb12u1
2.52.6-1~deb13u12.54.0-1~deb13u32.52.6-12.54.2-2
debian/wpewebkit<=2.38.6-1, <=2.48.3-1
2.54.2-1
Mozilla Firefox<126
126

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Thunderbird to a version that resolves this vulnerability.

    Fixed in 115.11
  2. Upgrade

    Upgrade Firefox ESR to a version that resolves this vulnerability.

    Fixed in 115.11
  3. Upgrade

    Upgrade npm/pdfjs-dist to a version that resolves this vulnerability.

    Fixed in 4.2.67
  4. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 115.11
  5. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 115.11
  6. Upgrade

    Upgrade debian/firefox-esr to a version that resolves this vulnerability.

    Fixed in 115.11.0esr-1~deb12u1
  7. Upgrade

    Upgrade debian/firefox-esr to a version that resolves this vulnerability.

    Fixed in 115.11.0esr-1
  8. Upgrade

    Upgrade debian/thunderbird to a version that resolves this vulnerability.

    Fixed in 1:115.11.0-1~deb12u1
  9. Upgrade

    Upgrade debian/thunderbird to a version that resolves this vulnerability.

    Fixed in 1:115.11.0-1
  10. Upgrade

    Upgrade debian/webkit2gtk to a version that resolves this vulnerability.

    Fixed in 2.52.5-1~deb13u1
  11. Upgrade

    Upgrade debian/webkit2gtk to a version that resolves this vulnerability.

    Fixed in 2.52.5-1
  12. Upgrade

    Upgrade debian/wpewebkit to a version that resolves this vulnerability.

    Fixed in 2.52.5-1
  13. Upgrade

    Upgrade debian/firefox to a version that resolves this vulnerability.

    Fixed in 159.0-1
  14. Upgrade

    Upgrade debian/firefox-esr to a version that resolves this vulnerability.

    Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1
  15. Upgrade

    Upgrade debian/odoo to a version that resolves this vulnerability.

    Fixed in 19.0.0+dfsg-1
  16. Upgrade

    Upgrade debian/thunderbird to a version that resolves this vulnerability.

    Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
  17. Upgrade

    Upgrade debian/webkit2gtk to a version that resolves this vulnerability.

    Fixed in 2.52.6-1~deb13u1Fixed in 2.54.0-1~deb13u3Fixed in 2.52.6-1Fixed in 2.54.2-2
  18. Upgrade

    Upgrade debian/wpewebkit to a version that resolves this vulnerability.

    Fixed in 2.54.2-1
  19. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 126
  20. Configuration

    Set PDF.js option `isEvalSupported` to `false` to prevent attacker-controlled JavaScript execution via PDF handling (CVE-2024-4367).

    PDF.js isEvalSupported = false

Event History

May 7, 2024
Advisory Published
via GitHub·10:25 AM
May 14, 2024
CVE Published
via Mozilla·12:00 AM
Data Sourced
via Mozilla·12:00 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·05:21 PM
Data Sourced
via MITRE·05:21 PM
DescriptionWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·06:15 PM
DescriptionSeverityAffected Software
Data Sourced
via Red Hat·06:37 PM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2024-4367?

CVE-2024-4367 is assigned a critical severity due to the potential execution of unrestricted attacker-controlled JavaScript.

2

How do I fix CVE-2024-4367?

To fix CVE-2024-4367, update to the latest version of affected software, such as Firefox or Thunderbird, which includes the necessary patches.

3

What versions are affected by CVE-2024-4367?

CVE-2024-4367 affects versions of Firefox ESR up to 115.11 and Thunderbird up to 115.11.

4

What is the main risk associated with CVE-2024-4367?

The main risk of CVE-2024-4367 is that it allows attackers to execute malicious JavaScript within the context of the hosting domain.

5

Who is impacted by CVE-2024-4367?

Users of Mozilla Firefox ESR and Thunderbird, especially those utilizing pdf.js with eval support enabled, are at risk from CVE-2024-4367.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203