firefox -- multiple vulnerabilities

2024-12-10 · CVE-2024-11692, CVE-2024-11696, CVE-2024-11697, CVE-2024-11699 · VuXML entry

[email protected] reports: CVE-2024-11692: An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks. CVE-2024-11696: The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have …

Affected versions

• firefox < 133.0.0,2
• firefox-esr < 128.5,1
• thunderbird < 128.5; >= 129 < 133

By system

2 still vulnerable, 4 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.