Arbitrary Code Injection Affecting Firefox-ESR package, versions [,115.16) [116.0, 128.3)
Threat Intelligence
EPSS
0.09% (39th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UNMANAGED-FIREFOXESR-8145220
- published 2 Oct 2024
- disclosed 1 Oct 2024
- credit Masato Kinugawa
How to fix?
Upgrade Firefox-ESR to version 115.16, 128.3 or higher.
Overview
Affected versions of this package are vulnerable to Arbitrary Code Injection via a multipart response, under the resource://pdf.js origin, which allows an attacker to access cross-origin PDF content.
Note: The Site Isolation feature on desktop clients limits this access to "same site" documents. Full cross-origin access is possible on Android versions only.