CVE-2024-11696

The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1929600	Issue Tracking
https://www.mozilla.org/security/advisories/mfsa2024-63/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-64/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-67/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-68/	Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/11/msg00029.html

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mozilla:firefox:::::esr:::*
	cpe:2.3:a:mozilla:firefox:::::-:::*
	cpe:2.3:a:mozilla:thunderbird::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

History

03 Nov 2025, 22:16

Type	Values Removed	Values Added
References		() https://lists.debian.org/debian-lts-announce/2024/11/msg00029.html -

Information

Published : 2024-11-26 14:15

Updated : 2025-11-03 22:16

NVD link : CVE-2024-11696

Mitre link : CVE-2024-11696

CVE.ORG link : CVE-2024-11696

JSON object : View

Products Affected

mozilla

thunderbird
firefox

CWE

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2024-11696", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2024-11-26T14:15:19.143", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1929600", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-63/", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-64/", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-67/", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-68/", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00029.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5."}, {"lang": "es", "value": "La aplicaci\u00f3n no tuvo en cuenta las excepciones generadas por el m\u00e9todo `loadManifestFromFile` durante la verificaci\u00f3n de la firma del complemento. Esta falla, provocada por un manifiesto de extensi\u00f3n no v\u00e1lido o no compatible, podr\u00eda haber causado errores de tiempo de ejecuci\u00f3n que interrumpieron el proceso de validaci\u00f3n de la firma. Como resultado, es posible que se haya omitido la aplicaci\u00f3n de la validaci\u00f3n de la firma para complementos no relacionados. La validaci\u00f3n de la firma en este contexto se utiliza para garantizar que las aplicaciones de terceros en la computadora del usuario no hayan alterado las extensiones del usuario, lo que limita el impacto de este problema. Esta vulnerabilidad afecta a Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133 y Thunderbird < 128.5."}], "lastModified": "2025-11-03T22:16:38.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "vulnerable": true, "matchCriteriaId": "883C5169-FA69-4478-BE73-4F36AB746D39", "versionEndExcluding": "128.5.0"}, {"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "B0358306-5BCC-49DE-B7A5-429C8BC71BBA", "versionEndExcluding": "133.0"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C047DD2-FCBA-4474-8AAE-DBB9A5142E4F", "versionEndExcluding": "128.5.0"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "809C8F59-3AAB-49E8-9F18-6884EC6E4E92", "versionEndExcluding": "133.0", "versionStartIncluding": "129.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}