CVE-2024-11704

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 133 Thunderbird versions prior to 133 Firefox ESR versions prior to 128.7 Thunderbird versions prior to 128.7

Description: A double-free issue could occur in the sec pkcs7 decoder start decrypt() function when handling an error path, potentially leading to memory corruption. This issue affects the confidentiality, integrity, and availability of protected information.

Recommendations: For Firefox versions prior to 133, update to version 133 or later. For Thunderbird versions prior to 133, update to version 133 or later. For Firefox ESR versions prior to 128.7, update to version 128.7 or later. For Thunderbird versions prior to 128.7, update to version 128.7 or later. As a temporary workaround, consider disabling the sec pkcs7 decoder start decrypt() function until a patch is available.