Vulnerability CVE-2024-11704: Information

Description

A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the same symmetric key could have been freed twice, potentially leading to memory corruption. This vulnerability affects Firefox < 133, Thunderbird < 133, Firefox ESR < 128.7, and Thunderbird < 128.7.

Severity: CRITICAL (9.8)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-11704

Published: Nov. 26, 2024

Modified: June 17, 2026

Error type identifier: CWE-415

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
firefox	sisyphus	133.0.0-alt1	152.0.6-alt1	ALT-PU-2024-16341-3	363536	Fixed
firefox	sisyphus_riscv64	133.0.3-alt0.port	152.0.4-alt0.port	ALT-PU-2024-17555-1	-	Fixed
firefox	sisyphus_loongarch64	133.0.3-alt0.port	152.0.4-alt0.port	ALT-PU-2024-17515-1	-	Fixed
firefox	p11	133.0.0-alt1	152.0.4-alt1	ALT-PU-2024-16375-4	363732	Fixed
firefox	p10	134.0.2-alt0.p10.1	141.0.2-alt0.p10.1	ALT-PU-2025-2230-4	372243	Fixed
firefox-esr	sisyphus	128.7.0-alt1	140.12.0-alt1	ALT-PU-2025-2782-3	374549	Fixed
firefox-esr	sisyphus_loongarch64	128.8.1-alt0.port	140.9.1-alt0.port	ALT-PU-2025-5491-1	-	Fixed
firefox-esr	p11	128.7.0-alt1	140.12.0-alt1	ALT-PU-2025-2842-4	374623	Fixed
firefox-esr	p10	128.7.0-alt1	140.12.0-alt0.p10.1	ALT-PU-2025-3294-4	375522	Fixed
firefox-esr	c10f2	128.10.1-alt0.c10.1	140.12.0-alt1	ALT-PU-2025-8709-4	388123	Fixed
palemoon	sisyphus	33.5.1-alt1	34.3.1-alt1	ALT-PU-2025-1567-4	370544	Fixed
palemoon	p11	33.6.0-alt1	34.3.1-alt1	ALT-PU-2025-2672-4	374394	Fixed
palemoon	p10	33.7.1-alt1	33.7.1-alt1	ALT-PU-2025-8904-2	384191	Fixed
palemoon	c10f2	33.8.1.2-alt1	33.8.1.2-alt1	ALT-PU-2025-10922-3	393313	Fixed
thunderbird	sisyphus	128.7.0-alt1	152.0.1-alt1	ALT-PU-2025-2615-3	374232	Fixed
thunderbird	sisyphus_riscv64	128.7.0-alt1	151.0.1-alt1	ALT-PU-2025-2688-1	-	Fixed
thunderbird	sisyphus_loongarch64	128.7.0-alt1	152.0.1-alt1	ALT-PU-2025-2638-1	-	Fixed
thunderbird	p11	128.8.0-alt1	152.0-alt1	ALT-PU-2025-4001-4	377410	Fixed
thunderbird	p10	138.0-alt1.p10.1	145.0-alt0.p10.1	ALT-PU-2025-7695-3	385484	Fixed
thunderbird	c10f2	141.0-alt0.p10.1	145.0-alt0.p10.1	ALT-PU-2025-11560-14	394393	Fixed

References to Advisories, Solutions, and Tools

Hyperlink	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1899402	Issue Tracking Permissions Required
https://www.mozilla.org/security/advisories/mfsa2024-63/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-67/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-09/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-10/	Vendor Advisory
https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html
https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html
BDU:2025-00073	BDU

Affected configurations:
1. cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
  End excluding
  128.7.0
  cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
  End excluding
  133.0
  cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
  End excluding
  128.7.0
  cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
  Start including
  129.0
  End excluding
  133.0

Version: v26.6.1