CVE-2024-11699

Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.

• CWE-94

• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1880582%2C1929911Issue Tracking
• https://www.mozilla.org/security/advisories/mfsa2024-63/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2024-64/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2024-67/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2024-68/Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/11/msg00029.html

Published

Nov 26, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-11693The executable file warning was not presented when downloadi…9.8
• CVE-2024-11694Enhanced Tracking Protection's Strict mode may have inadvert…6.1
• CVE-2024-11695A crafted URL containing Arabic script and whitespace charac…5.4
• CVE-2024-11696The application failed to account for exceptions thrown by t…5.4
• CVE-2024-11697When handling keypress events, an attacker may have been abl…8.8
• CVE-2024-11698A flaw in handling fullscreen transitions may have inadverte…9.8
• CVE-2024-1170The Post Form – Registration Form – Profile Form for User Pr…8.2
• CVE-2024-11700Malicious websites may have been able to perform user intent…8.1
• CVE-2024-11701The incorrect domain may have been displayed in the address …4.3
• CVE-2024-11702Copying sensitive information from Private Browsing tabs on …7.5
• CVE-2024-11703On Android, Firefox may have inadvertently allowed viewing s…5.7
• CVE-2024-11704A double-free issue could have occurred in `sec_pkcs7_decode…9.8