CVE-2024-11704
📋 TL;DR
A double-free vulnerability in Firefox and Thunderbird's PKCS7 decryption function could allow memory corruption when processing malformed encrypted data. Attackers could potentially execute arbitrary code or cause application crashes. All users of affected Firefox, Thunderbird, and Firefox ESR versions are vulnerable.
💻 Affected Systems
- Firefox
- Thunderbird
- Firefox ESR
📦 What is this software?
Firefox by Mozilla
Firefox by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash (denial of service) or limited memory corruption that could be leveraged for further exploitation.
If Mitigated
Application crash with no data loss if sandboxing and other security controls prevent escalation.
🎯 Exploit Status
Exploitation requires delivering malicious PKCS7 data, potentially via web content or email. No public exploit code known at time of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 133+, Thunderbird 133+, Firefox ESR 128.7+, Thunderbird ESR 128.7+
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-63/
Restart Required: Yes
Instructions:
1. Open browser/email client. 2. Go to Help > About Firefox/Thunderbird. 3. Allow automatic update to complete. 4. Restart application when prompted.
🔧 Temporary Workarounds
Disable PKCS7 processing
allBlock PKCS7 decryption functionality via enterprise policies or configuration
Not applicable - requires enterprise policy configuration
🧯 If You Can't Patch
- Restrict web content to trusted sites only using content filtering
- Disable automatic loading of external content in email clients
🔍 How to Verify
Check if Vulnerable:
Check application version in Help > About menu. If version is below patched versions listed, system is vulnerable.Check Version:
firefox --version or thunderbird --version on Linux/macOSVerify Fix Applied:
Confirm version is at or above Firefox 133, Thunderbird 133, Firefox ESR 128.7, or Thunderbird ESR 128.7.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory corruption errors
- Unexpected termination of Firefox/Thunderbird processes
Network Indicators:
- Inbound connections delivering encrypted content to browsers/email clients
SIEM Query:
source="firefox" OR source="thunderbird" AND (event_type="crash" OR error="double-free" OR error="memory corruption")🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1899402
- https://www.mozilla.org/security/advisories/mfsa2024-63/
- https://www.mozilla.org/security/advisories/mfsa2024-67/
- https://www.mozilla.org/security/advisories/mfsa2025-09/
- https://www.mozilla.org/security/advisories/mfsa2025-10/
- https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html
- https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html
