CVE-2024-11705 — NULL Pointer Dereference in Mozilla Firefox

CWE-476 — NULL Pointer DereferenceCWE-125 — Out-of-bounds Read10 documents8 sources
Severity
9.1CRITICALNVD
OSV4.3
EPSS
0.3%
top 50.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxMozilla Thunderbird
Timeline
PublishedNov 26
Latest updateDec 3

Description

`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior conflicted with the PKCS#11 v3.0 specification, which allows `phKey` to be NULL for certain mechanisms. This vulnerability affects Firefox < 133 and Thunderbird < 133.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages5 packages

▶CVEListV5mozilla/firefoxunspecified — 133
▶NVDmozilla/firefox< 133.0
▶CVEListV5mozilla/thunderbirdunspecified — 133
▶NVDmozilla/thunderbird< 133.0
▶Ubuntumozilla/firefox< 133.0+build2-0ubuntu0.20.04.1

🔴Vulnerability Details

4
OSV
firefox vulnerabilities↗2024-12-03
▶
OSV
CVE-2024-11705: `NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL↗2024-11-26
▶
GHSA
GHSA-h43c-gg33-qj9g: `NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL↗2024-11-26
▶
CVEList
CVE-2024-11705: `NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL↗2024-11-26
▶

📋Vendor Advisories

5
Ubuntu
Firefox vulnerabilities↗2024-12-03
▶
Red Hat
firefox: thunderbird: Null Pointer Dereference in NSC_DeriveKey↗2024-11-26
▶
Debian
CVE-2024-11705: firefox - `NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-N...↗2024
▶
Mozilla
Mozilla Foundation Security Advisory 2024-67: CVE-2024-11705↗
▶
Mozilla
Mozilla Foundation Security Advisory 2024-63: CVE-2024-11705↗
▶
CVE-2024-11705 — NULL Pointer Dereference in Mozilla | cvebase