CVE-2024-4367

Published May 14, 2024

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-4367 is a vulnerability in PDF.js, a JavaScript-based PDF viewer. It stems from a missing type check when handling fonts, specifically during glyph path compilation for Type 1 fonts. The issue occurs in the FontFaceObject.getPathGenerator method, where font matrix values from PDF dictionaries are not properly validated before being used in JavaScript code generation. Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the PDF.js context. This could enable malicious actors to perform actions such as spying on user activity, triggering unauthorized downloads (including file:// URLs), and leaking PDF file paths. Web applications that utilize PDF.js may be susceptible to stored Cross-Site Scripting (XSS) attacks. The vulnerability affects Firefox versions prior to 126, Firefox ESR versions earlier than 115.11, and Thunderbird versions before 115.11.

Description
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
Source
security@mozilla.org
NVD status
Modified

Risk scores

CVSS 3.1

Type
Primary
Base score
8.8
Impact score
5.9
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

nvd@nist.gov
NVD-CWE-noinfo
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-754

Social media

Hype score
Not currently trending

Configurations