CVE-2024-11697
When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog. This could have led to malicious code execution. This
02 Description
When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog. This could have led to malicious code execution. This
03 Exploitation and scoring
- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
- EPSS probability
- 0.76% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 55.0% of scored records. A rank, not a probability.
- NVD base score
- 8.8 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- Low. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2024-11-26 13:33Z1 YR AGO
- Last updated
- 2025-11-03 21:52Z11 MO AGO
- Reserved
- 2024-11-25
- Assigning CNA
- mozilla
- Record state
- PUBLISHED
- Severity
- High (CVSS 8.8)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- Data version
- 5.2
- Document digest
- c1dc0852260b0e171562d6410c4721f27fad72079ea0f2a5f096d9b6b284add5
05 Affected products
06 References
- bugzilla.mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=1842187
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2024-63/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2024-64/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2024-67/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2024-68/
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2024/11/msg00029.html
07 Fixed in
AlmaLinux 8
- firefox Fixed in 128.5.1-1.el8_10
- thunderbird Fixed in 128.5.0-1.el8_10.alma.1
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
AlmaLinux 9
- firefox Fixed in 128.5.1-1.el9_5
- firefox-x11 Fixed in 128.5.1-1.el9_5
- thunderbird Fixed in 128.5.0-1.el9_5.alma.1
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
AlmaLinux 10
- qemu-guest-agent Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-img Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-audio-pa Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-block-blkio Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-block-curl Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-block-rbd Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-common Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-core Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-device-display-virtio-gpu Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-device-display-virtio-gpu-ccw Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-device-display-virtio-gpu-pci Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-device-display-virtio-vga Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-device-usb-host Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-device-usb-redirect Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-docs Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-tools Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-ui-egl-headless Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-ui-opengl Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-pr-helper Fixed in 18:10.1.0-16.el10_2.alma.1
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
CloudLinux 8
- firefox Fixed in 128.5.1-1.el8_10
- thunderbird Fixed in 128.5.0-1.el8_10.alma.1
Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
CloudLinux 9
- firefox Fixed in 128.5.1-1.el9_5
- firefox-x11 Fixed in 128.5.1-1.el9_5
- thunderbird Fixed in 128.5.0-1.el9_5.alma.1
Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
CloudLinux 10
- qemu-guest-agent Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-img Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-audio-pa Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-block-blkio Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-block-curl Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-block-rbd Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-common Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-core Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-device-display-virtio-gpu Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-device-display-virtio-gpu-ccw Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-device-display-virtio-gpu-pci Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-device-display-virtio-vga Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-device-usb-host Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-device-usb-redirect Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-docs Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-tools Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-ui-egl-headless Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-kvm-ui-opengl Fixed in 18:10.1.0-16.el10_2.alma.1
- qemu-pr-helper Fixed in 18:10.1.0-16.el10_2.alma.1
Derived from AlmaLinux 10. Partial coverage: only packages taken from AlmaLinux 10 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
Debian 12
- firefox-esr Fixed in 128.5.0esr-1~deb12u1
- thunderbird Fixed in 1:128.5.0esr-1~deb12u1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 13
- firefox-esr Fixed in 128.5.0esr-1
- thunderbird Fixed in 1:128.5.0esr-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 14
- firefox-esr Fixed in 128.5.0esr-1
- thunderbird Fixed in 1:128.5.0esr-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 18.04 LTS
- mozjs38 No fix yet
- mozjs52 No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 20.04 LTS
- firefox Fixed in 133.0+build2-0ubuntu0.20.04.1
- mozjs52 No fix yet
- mozjs68 No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 22.04 LTS
- mozjs102 No fix yet
- mozjs78 No fix yet
- mozjs91 No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 24.04 LTS
- mozjs102 No fix yet
- mozjs115 No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.