Bug 945049 – [Tracker] Mozilla Foundation Security Advisory for November 26, 2024

• Status: CONFIRMED
• Product: Gentoo Security

[Description Christopher Fore 2024-11-26 18:19:53 UTC]

CVE-2024-11692:

An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks.


CVE-2024-11694:

Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content.


CVE-2024-11695:

A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack.


CVE-2024-11696:

The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed.  Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue.


CVE-2024-11697:

When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog. This could have led to malicious code execution.


CVE-2024-11699:

Memory safety bugs present in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.


CVE-2024-11700:

Malicious websites may have been able to user intent confirmation through tapjacking. This could have led to users unknowingly approving the launch of external applications, potentially exposing them to underlying vulnerabilities.


CVE-2024-11701:

The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confusion and possible spoofing attacks.


CVE-2024-11704:

A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the same symmetric key could have been freed twice, potentially leading to memory corruption.


CVE-2024-11705:

NSC_DeriveKey inadvertently assumed that the phKey parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior conflicted with the PKCS#11 v3.0 specification, which allows phKey to be NULL for certain mechanisms.


CVE-2024-11706:

A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the SEC_ASN1DecodeItem_Util function, when handling malformed or improperly formatted input files.


CVE-2024-11708:

Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure.



Firefox 133: https://www.mozilla.org/en-US/security/advisories/mfsa2024-63/

Firefox ESR 128.5: https://www.mozilla.org/en-US/security/advisories/mfsa2024-64/

Firefox ESR 115.18: https://www.mozilla.org/en-US/security/advisories/mfsa2024-65/

Thunderbird 133: https://www.mozilla.org/en-US/security/advisories/mfsa2024-67/

Thunderbird 128.5: https://www.mozilla.org/en-US/security/advisories/mfsa2024-68/