8.8

CVE-2024-4367: debian debian_linux

CVSS: 8.8v3.1HighModified
AliasesUBUNTU-CVE-2024-4367DEBIAN-CVE-2024-4367DSA-5742-1
Published 14-05-2024Last modified 12-05-2026
Open JSON

Vulnerability summary

CVE-2024-4367 is a high (CVSS 8.8) vulnerability in debian debian_linux. EPSS estimates a 70.66% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
59/100
0100
High · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (NVD)
EPSS score
70.66%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 47 · Related 17
DLA-3815-1DLA-3817-1DSA-5691-1DSA-5693-1MGASA-2024-0189MGASA-2024-0191

Timeline

  1. 14-05-2024
    PublishedVulnerability first disclosed.
  2. 12-05-2026
    Last modifiedVulnerability information updated.

Description

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

70.66%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 70.66% on 19-09-2026

19-09-202619-10-2026
EPSS score
70.66%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • exploit-databaseremotemultipleUnverified

    Firefox ESR 115.11 - PDF.js Arbitrary JavaScript execution

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Wordpress11 products
  • 3d-flipbook-dflip-lite≤ 1.15.5 (fixed in 1.15.6)
  • ari-fancy-lightbox≤ 1.3.14 (fixed in 1.3.15)
  • bsk-pdf-manager≤ 3.6 (fixed in 3.6.1)
  • embedpress≤ 4.0.2 (fixed in 4.0.3)
  • pdf-embedder≤ 4.7.1 (fixed in 4.8.0)
Ubuntu8 products
  • firefox< 126.0+build2-0ubuntu0.20.04.1
  • mozjs102All versions (No fix recorded)
  • mozjs38All versions (No fix recorded)
  • mozjs52All versions (No fix recorded)
  • mozjs68All versions (No fix recorded)
Debian6 products
  • firefox-esr< 115.11.0esr-1~deb12u1 | < 115.11.0esr-1
  • odoo< 14.0.0+dfsg.2-7+deb11u2
  • thunderbird< 1:115.11.0-1~deb12u1 | < 1:115.11.0-1
  • webkit2gtkAll versions (No fix recorded) | < 2.52.5-1~deb13u1 | < 2.52.5-1
  • wpewebkitAll versions (No fix recorded) | < 2.52.5-1
Mozilla3 products
Chainguard1 product
  • firefox-esr< 115.11.0-r0
Npm1 product
  • pdfjs-dist< 4.2.67
Open-xchange1 product
  • open-xchange_appsuite_frontend< 7.10.6 | 7.10.6 | 7.10.6:revision10 | 7.10.6:revision11 | 7.10.6:revision12 | 7.10.6:revision13 | 7.10.6:revision14 | 7.10.6:revision15 | 7.10.6:revision16 | 7.10.6:revision17 | 7.10.6:revision18 | 7.10.6:revision19 | 7.10.6:revision20 | 7.10.6:revision21 | 7.10.6:revision22 | 7.10.6:revision23 | 7.10.6:revision24 | 7.10.6:revision25 | 7.10.6:revision26 | 7.10.6:revision27 | 7.10.6:revision28 | 7.10.6:revision29 | 7.10.6:revision3 | 7.10.6:revision30 | 7.10.6:revision31 | 7.10.6:revision32 | 7.10.6:revision33 | 7.10.6:revision34 | 7.10.6:revision35 | 7.10.6:revision36 | 7.10.6:revision37 | 7.10.6:revision38 | 7.10.6:revision39 | 7.10.6:revision4 | 7.10.6:revision40 | 7.10.6:revision41 | 7.10.6:revision42 | 7.10.6:revision43 | 7.10.6:revision44 | 7.10.6:revision5 | 7.10.6:revision6 | 7.10.6:revision7 | 7.10.6:revision8 | 7.10.6:revision9

7 vendors · 31 products

References

31 links
Show all 31 references