alpine · CVE-2024-4367

Quick triage

View at Official alpine advisory, NVD, CVE.org · CVE detail

Freshness: no update timestamp found; verify against the upstream OS advisory manually.

Tracker summary

CVE-2024-4367: 3 source package rows (firefox, firefox-esr, thunderbird); 293 state rows across 2 repos (3.22-community, edge-community); fixed 0, open 293.

Description:

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.