Improper Check for Unusual or Exceptional Conditions
CVE-2024-4367
Summary
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This issue affects pdfjs-dist package versions prior to 4.2.67. This issue also affects Firefox versions prior to 126, Firefox ESR versions prior to 115.11, and Thunderbird versions prior to 115.11.
- LOW
- NETWORK
- HIGH
- UNCHANGED
- REQUIRED
- NONE
- HIGH
- HIGH
CWE-754 - Improper Check for Unusual or Exceptional Conditions
The software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.
References
Advisory Timeline
- Published
