{"schemaVersion":3,"id":"CVE-2024-4367","aliases":["UBUNTU-CVE-2024-4367","DEBIAN-CVE-2024-4367","DSA-5742-1","GHSA-wgrm-67xf-hhpq","CGA-43wc-m792-qhrx","CGA-w68m-mcj3-9mhh"],"status":"published","duplicateOf":null,"title":null,"description":"A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.","dates":{"published":"2024-05-14T17:21:23.486Z","modified":"2026-05-12T11:30:41.220Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.6,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":5.6,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","exploitability":5.6,"impact":5.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":5.6,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","exploitability":5.6,"impact":5.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":6.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.7066,"percentile":0.99392,"severity":"critical","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.7066},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.7066,"percentile":0.99392}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.7066,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.7066,"percentile":0.99392}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"52273","name":"Firefox ESR 115.11 - PDF.js Arbitrary JavaScript execution","source":"exploit-database","url":"https://www.exploit-db.com/exploits/52273","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/52273.py","codes":["CVE-2024-4367"]},"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-754","name":"Improper Check for Unusual or Exceptional Conditions","description":"The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/754.html"},{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"chainguard","product":"firefox-esr","name":"firefox-esr","label":"firefox-esr","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/firefox-esr","purlType":"apk","versions":[{"text":"< 115.11.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 115.11.0-r0","eol":null,"hubHref":null},{"vendor":"debian","product":"firefox-esr","name":"firefox-esr","label":"firefox-esr","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/firefox-esr","purlType":"deb","versions":[{"text":"< 115.11.0esr-1~deb12u1","noFixRecorded":false,"fixedIn":null},{"text":"< 115.11.0esr-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 115.11.0esr-1~deb12u1 | < 115.11.0esr-1","eol":null,"hubHref":null},{"vendor":"debian","product":"odoo","name":"odoo","label":"odoo","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/odoo","purlType":"deb","versions":[{"text":"< 14.0.0+dfsg.2-7+deb11u2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 14.0.0+dfsg.2-7+deb11u2","eol":null,"hubHref":null},{"vendor":"debian","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/thunderbird","purlType":"deb","versions":[{"text":"< 1:115.11.0-1~deb12u1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:115.11.0-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:115.11.0-1~deb12u1 | < 1:115.11.0-1","eol":null,"hubHref":null},{"vendor":"debian","product":"webkit2gtk","name":"webkit2gtk","label":"webkit2gtk","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/webkit2gtk","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 2.52.5-1~deb13u1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.52.5-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 2.52.5-1~deb13u1 | < 2.52.5-1","eol":null,"hubHref":null},{"vendor":"debian","product":"wpewebkit","name":"wpewebkit","label":"wpewebkit","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/wpewebkit","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 2.52.5-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 2.52.5-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"firefox","name":"firefox","label":"firefox","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/firefox","purlType":"deb","versions":[{"text":"< 126.0+build2-0ubuntu0.20.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 126.0+build2-0ubuntu0.20.04.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"mozjs102","name":"mozjs102","label":"mozjs102","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/mozjs102","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"mozjs38","name":"mozjs38","label":"mozjs38","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/mozjs38","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"mozjs52","name":"mozjs52","label":"mozjs52","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/mozjs52","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"mozjs68","name":"mozjs68","label":"mozjs68","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/mozjs68","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"mozjs78","name":"mozjs78","label":"mozjs78","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/mozjs78","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"mozjs91","name":"mozjs91","label":"mozjs91","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/mozjs91","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/thunderbird","purlType":"deb","versions":[{"text":"< 1:115.11.0+build2-0ubuntu0.20.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:115.11.0+build2-0ubuntu0.22.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:115.11.0+build2-0ubuntu0.20.04.1 | < 1:115.11.0+build2-0ubuntu0.22.04.1","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"10.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"10.0","eol":{"isEol":true,"eolDate":"2024-06-30T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"10","label":"10 (Buster)","eolFrom":"2024-06-30T00:00:00.000Z","isLts":false,"isMaintained":true,"latestVersion":"10.13"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"mozilla","product":"firefox","name":"Firefox","label":"firefox","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 126","noFixRecorded":false,"fixedIn":null},{"text":"< 115.11.0","noFixRecorded":false,"fixedIn":null},{"text":"< 126.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 126 | < 115.11.0 | < 126.0","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"firefox","label":"Firefox","category":"app"}},"hubHref":"/vendor/mozilla/firefox"},{"vendor":"mozilla","product":"firefox_esr","name":"firefox esr","label":"firefox_esr","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 115.11","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 115.11","eol":null,"hubHref":"/vendor/mozilla/firefox_esr"},{"vendor":"mozilla","product":"thunderbird","name":"Thunderbird","label":"thunderbird","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 115.11","noFixRecorded":false,"fixedIn":null},{"text":"< 115.11.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 115.11 | < 115.11.0","eol":null,"hubHref":"/vendor/mozilla/thunderbird"},{"vendor":"Npm","product":"pdfjs-dist","name":"pdfjs-dist","label":"pdfjs-dist","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/pdfjs-dist","purlType":"npm","versions":[{"text":"< 4.2.67","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2.67","eol":null,"hubHref":null},{"vendor":"open-xchange","product":"open-xchange_appsuite_frontend","name":"open-xchange appsuite frontend","label":"open-xchange_appsuite_frontend","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.10.6","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision10","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision11","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision12","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision13","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision14","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision15","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision16","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision17","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision18","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision19","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision20","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision21","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision22","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision23","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision24","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision25","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision26","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision27","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision28","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision29","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision3","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision30","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision31","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision32","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision33","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision34","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision35","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision36","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision37","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision38","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision39","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision4","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision40","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision41","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision42","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision43","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision44","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision5","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision6","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision7","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision8","noFixRecorded":false,"fixedIn":null},{"text":"7.10.6:revision9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.10.6 | 7.10.6 | 7.10.6:revision10 | 7.10.6:revision11 | 7.10.6:revision12 | 7.10.6:revision13 | 7.10.6:revision14 | 7.10.6:revision15 | 7.10.6:revision16 | 7.10.6:revision17 | 7.10.6:revision18 | 7.10.6:revision19 | 7.10.6:revision20 | 7.10.6:revision21 | 7.10.6:revision22 | 7.10.6:revision23 | 7.10.6:revision24 | 7.10.6:revision25 | 7.10.6:revision26 | 7.10.6:revision27 | 7.10.6:revision28 | 7.10.6:revision29 | 7.10.6:revision3 | 7.10.6:revision30 | 7.10.6:revision31 | 7.10.6:revision32 | 7.10.6:revision33 | 7.10.6:revision34 | 7.10.6:revision35 | 7.10.6:revision36 | 7.10.6:revision37 | 7.10.6:revision38 | 7.10.6:revision39 | 7.10.6:revision4 | 7.10.6:revision40 | 7.10.6:revision41 | 7.10.6:revision42 | 7.10.6:revision43 | 7.10.6:revision44 | 7.10.6:revision5 | 7.10.6:revision6 | 7.10.6:revision7 | 7.10.6:revision8 | 7.10.6:revision9","eol":null,"hubHref":"/vendor/open-xchange/open-xchange_appsuite_frontend"},{"vendor":"wordpress","product":"3d-flipbook-dflip-lite","name":"DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer","label":"3d-flipbook-dflip-lite","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.15.5 (fixed in 1.15.6)","noFixRecorded":false,"fixedIn":"1.15.6"}],"versionsText":"≤ 1.15.5 (fixed in 1.15.6)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"ari-fancy-lightbox","name":"ARI Fancy Lightbox – Popup for WordPress","label":"ari-fancy-lightbox","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.3.14 (fixed in 1.3.15)","noFixRecorded":false,"fixedIn":"1.3.15"}],"versionsText":"≤ 1.3.14 (fixed in 1.3.15)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"bsk-pdf-manager","name":"BSK PDF Manager","label":"bsk-pdf-manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.6 (fixed in 3.6.1)","noFixRecorded":false,"fixedIn":"3.6.1"}],"versionsText":"≤ 3.6 (fixed in 3.6.1)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"embedpress","name":"EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents","label":"embedpress","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 4.0.2 (fixed in 4.0.3)","noFixRecorded":false,"fixedIn":"4.0.3"}],"versionsText":"≤ 4.0.2 (fixed in 4.0.3)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"pdf-embedder","name":"PDF Embedder – PDF Viewer & Embed PDF Files for WordPress","label":"pdf-embedder","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 4.7.1 (fixed in 4.8.0)","noFixRecorded":false,"fixedIn":"4.8.0"}],"versionsText":"≤ 4.7.1 (fixed in 4.8.0)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"pdf-poster","name":"PDF Poster – Let visitors read PDF's without leaving the page","label":"pdf-poster","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.1.21 (fixed in 2.1.22)","noFixRecorded":false,"fixedIn":"2.1.22"}],"versionsText":"≤ 2.1.21 (fixed in 2.1.22)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"pdf-viewer-for-elementor","name":"PDF Viewer for Elementor","label":"pdf-viewer-for-elementor","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.9.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.9.3","eol":null,"hubHref":null},{"vendor":"wordpress","product":"pdfjs-viewer-for-elementor","name":"PDF viewer for Elementor & Gutenberg","label":"pdfjs-viewer-for-elementor","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.3.2","eol":null,"hubHref":null},{"vendor":"wordpress","product":"pdfjs-viewer-shortcode","name":"PDF.js Viewer","label":"pdfjs-viewer-shortcode","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.1.8.1 (fixed in 2.2)","noFixRecorded":false,"fixedIn":"2.2"}],"versionsText":"≤ 2.1.8.1 (fixed in 2.2)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"tainacan","name":"Tainacan","label":"tainacan","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 0.21.5 (fixed in 0.21.6)","noFixRecorded":false,"fixedIn":"0.21.6"}],"versionsText":"≤ 0.21.5 (fixed in 0.21.6)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"wonderplugin-pdf-embed","name":"Wonder PDF Embed","label":"wonderplugin-pdf-embed","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.7 (fixed in 2.8)","noFixRecorded":false,"fixedIn":"2.8"}],"versionsText":"≤ 2.7 (fixed in 2.8)","eol":null,"hubHref":null}],"affectedCount":31,"eol":{"hasEol":true,"count":1},"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1893645","label":"bugzilla.mozilla.org/show_bug.cgi?id=1893645","hostname":"bugzilla.mozilla.org","tags":["REPORT","WEB","Issue Tracking"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-21/","label":"www.mozilla.org/security/advisories/mfsa2024-21/","hostname":"www.mozilla.org","tags":["REPORT","Advisory","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-22/","label":"www.mozilla.org/security/advisories/mfsa2024-22/","hostname":"www.mozilla.org","tags":["REPORT","Advisory","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-23/","label":"www.mozilla.org/security/advisories/mfsa2024-23/","hostname":"www.mozilla.org","tags":["REPORT","Advisory","Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html","label":"lists.debian.org/debian-lts-announce/2024/05/msg00010.html","hostname":"lists.debian.org","tags":["WEB","Mailing List"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html","label":"lists.debian.org/debian-lts-announce/2024/05/msg00012.html","hostname":"lists.debian.org","tags":["WEB","Mailing List"]},{"url":"http://seclists.org/fulldisclosure/2024/Aug/30","label":"seclists.org/fulldisclosure/2024/Aug/30","hostname":"seclists.org","tags":["WEB","Mailing List"]},{"url":"https://github.com/mozilla/pdf.js/releases/tag/v4.2.67","label":"github.com/mozilla/pdf.js/releases/tag/v4.2.67","hostname":"github.com","tags":["WEB"]},{"url":"https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/","label":"codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/","hostname":"codeanlabs.com","tags":["ARTICLE"]},{"url":"https://github.com/gogs/gogs/issues/7928","label":"github.com/gogs/gogs/issues/7928","hostname":"github.com","tags":["WEB","REPORT"]},{"url":"https://www.exploit-db.com/exploits/52273","label":"www.exploit-db.com/exploits/52273","hostname":"www.exploit-db.com","tags":["WEB"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-827383.html","label":"cert-portal.siemens.com/productcert/html/ssa-827383.html","hostname":"cert-portal.siemens.com","tags":["WEB"]},{"url":"https://ubuntu.com/security/CVE-2024-4367","label":"ubuntu.com/security/CVE-2024-4367","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4367","label":"www.cve.org/CVERecord?id=CVE-2024-4367","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2024-21/#CVE-2024-4367","label":"www.mozilla.org/en-US/security/advisories/mfsa2024-21/","hostname":"www.mozilla.org","tags":["REPORT"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2024-22/#CVE-2024-4367","label":"www.mozilla.org/en-US/security/advisories/mfsa2024-22/","hostname":"www.mozilla.org","tags":["REPORT"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2024-23/#CVE-2024-4367","label":"www.mozilla.org/en-US/security/advisories/mfsa2024-23/","hostname":"www.mozilla.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-6779-1","label":"ubuntu.com/security/notices/USN-6779-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6782-1","label":"ubuntu.com/security/notices/USN-6782-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-4367","label":"security-tracker.debian.org/tracker/CVE-2024-4367","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq","label":"github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq","hostname":"github.com","tags":["WEB"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4367","label":"nvd.nist.gov/vuln/detail/CVE-2024-4367","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/mozilla/pdf.js/pull/18015","label":"github.com/mozilla/pdf.js/pull/18015","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6","label":"github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6","hostname":"github.com","tags":["WEB"]},{"url":"https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js","label":"codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js","hostname":"codeanlabs.com","tags":["WEB"]},{"url":"https://github.com/mozilla/pdf.js","label":"github.com/mozilla/pdf.js","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-21","label":"www.mozilla.org/security/advisories/mfsa2024-21","hostname":"www.mozilla.org","tags":["WEB"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-22","label":"www.mozilla.org/security/advisories/mfsa2024-22","hostname":"www.mozilla.org","tags":["WEB"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2024-23","label":"www.mozilla.org/security/advisories/mfsa2024-23","hostname":"www.mozilla.org","tags":["WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4367.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4367.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ce7aa01-7e79-4048-a84d-fcb9541d5f8b","label":"www.wordfence.com/threat-intel/vulnerabilities/id/8ce7aa01-7e79-4048-a84d-fcb9541d5f8b","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":["DLA-3815-1","DLA-3817-1","DSA-5691-1","DSA-5693-1","MGASA-2024-0189","MGASA-2024-0191","OPENSUSE-SU-2024:13980-1","OPENSUSE-SU-2024:13981-1","OPENSUSE-SU-2024:14572-1","OPENSUSE-SU-2026:21508-1","RHSA-2024:2881","RHSA-2024:2882","RHSA-2024:2883","RHSA-2024:2884","RHSA-2024:2885","RHSA-2024:2886","RHSA-2024:2887","RHSA-2024:2888","RHSA-2024:2903","RHSA-2024:2904","RHSA-2024:2905","RHSA-2024:2906","RHSA-2024:2911","RHSA-2024:2912","RHSA-2024:2913","RHSA-2024:3338","RHSA-2024:3783","RHSA-2024:3784","RHSA-2026:42062","RHSA-2026:42088","RHSA-2026:54572","RHSA-2026:54634","RHSA-2026:57348","RHSA-2026:58550","RHSA-2026:58564","RHSA-2026:59325","RHSA-2026:59326","SUSE-SU-2024:1676-1","SUSE-SU-2024:1770-1","SUSE-SU-2024:1858-1","SUSE-SU-2026:23111-1","SUSE-SU-2026:23133-1","SUSE-SU-2026:3338-1","SUSE-SU-2026:3396-1","SUSE-SU-2026:3555-1","USN-6779-1","USN-6782-1"],"duplicates":[],"related":["CGA-9PRP-5J33-CXV9","CGA-R47Q-8Q9V-57W9","CVE-2024-34342","OPENSUSE-SU-2024:13980-1","OPENSUSE-SU-2024:13981-1","OPENSUSE-SU-2024:14572-1","OPENSUSE-SU-2026:21508-1","SUSE-SU-2024:1676-1","SUSE-SU-2024:1770-1","SUSE-SU-2024:1858-1","SUSE-SU-2026:23111-1","SUSE-SU-2026:23133-1","SUSE-SU-2026:3338-1","SUSE-SU-2026:3396-1","SUSE-SU-2026:3555-1","USN-6779-1","USN-6782-1"]},"timeline":[{"kind":"published","date":"2024-05-14T17:21:23.486Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-05-12T11:30:41.220Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":59,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T19:29:27.616Z","stale":false,"partial":false}}