Published: 14/05/2024 Updated: 14/05/2024

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

Mozilla Foundation Security Advisory 2024-22 Security Vulnerabilities fixed in Firefox ESR 11511 Announced May 14, 2024 Impact high Products Firefox ESR Fixed in Firefox ESR 11511 ...

Mozilla Foundation Security Advisory 2024-21 Security Vulnerabilities fixed in Firefox 126 Announced May 14, 2024 Impact high Products Firefox Fixed in Firefox 126 ...

Mozilla Foundation Security Advisory 2024-23 Security Vulnerabilities fixed in Thunderbird 11511 Announced May 15, 2024 Impact high Products Thunderbird Fixed in Thunderbird 11511 ...

FishyPDF FishyPDF is a viewer and analyzer for inspecting suspicious PDF files It is based heavily on Mozilla's PDFjs with more secure defaults and some additional analysis features added Code structure Since this project is a modified version of the original PDFjs web viewer, some of the code is hard to cleanly separate The directory third_party/pdfjs/ contains a cop

CVE-2024-4367 arbitrary js execution in pdf js

CVE-2024-4367 POC Usage python pocpy maliciouspdf "alert\('S4vvy')" References CVE-2024-4367: Arbitrary JS Execution in PDFjs PDFjs

CVE-2024-4367, CVE-2024-34342 Proof of Concept

CVE-2024-4367: Arbitrary JavaScript execution in PDFjs A type check was missing when handling fonts in PDFjs, which would allow arbitrary JavaScript execution in the PDFjs context This vulnerability affects Firefox < 126, Firefox ESR < 11511, and Thunderbird < 11511 If pdfjs is used to load a malicious PDF, and PDFjs is configured with isEvalSuppor

CVE-2024-4367 mitigation for Odoo 14.0

pdfjs_disable_eval Module for disabling JavaScript evaluation in PDFjs This works around the missing fix in Odoo 140 for CVE-2024-4367

YARA detection rule for CVE-2024-4367 arbitrary javascript execution in PDF.js

Detect CVE-2024-4367 Quick-and-dirty YARA detection rule for CVE-2024-4367 arbitrary javascript execution in PDFjs Usage $ yara expl_pdfjs_cve_2024_4367yar poc_generalized_CVE-2024-4367pdf EXPL_PDFJS_CVE_2024_4367 poc_generalized_CVE-2024-4367pdf Credits POC and disclosure from codeanlabscom/blog/research/cve-2024-4367-arbit

https://bugzilla.mozilla.org/show_bug.cgi?id=1893645 https://www.mozilla.org/security/advisories/mfsa2024-21/https://www.mozilla.org/security/advisories/mfsa2024-22/https://www.mozilla.org/security/advisories/mfsa2024-23/https://nvd.nist.gov https://github.com/google/fishy-pdf https://github.com/s4vvysec/CVE-2024-4367-POC https://www.mozilla.org/en-US/security/advisories/mfsa2024-22/

CVE-2024-4367

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect