PatchGap
Firefox · Toolkit

CVE-2024-11697

Logic Error in Toolkit
Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionWhen handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog. This could have led to malicious code execution.
ComponentToolkit
Bug ClassLogic Error
Tracker1842187
Fix commit366f2f5d06b2 (firefox) +4/-1
CISA KEVNot listed
CreditedUmar Farooq
Disclosed2024-11-26

Files Changed

  • toolkit/components/downloads/DownloadUIHelper.sys.mjs

Patch

view commit
diff --git a/toolkit/components/downloads/DownloadUIHelper.sys.mjs b/toolkit/components/downloads/DownloadUIHelper.sys.mjs
index 0d1d0e0a319..d4b903d3839 100644
--- a/toolkit/components/downloads/DownloadUIHelper.sys.mjs
+++ b/toolkit/components/downloads/DownloadUIHelper.sys.mjs
@@ -171,7 +171,10 @@ DownloadPrompter.prototype = {
       "download-ui-file-executable-security-warning",
       { executable: PathUtils.filename(path) }
     );
-    return this._prompter.confirm(title, message);
+    let flags =
+      Ci.nsIPrompt.BUTTON_DELAY_ENABLE | Ci.nsIPrompt.STD_OK_CANCEL_BUTTONS;
+    let nulls = Array(4).fill(null);
+    return 0 == this._prompter.confirmEx(title, message, flags, ...nulls, {});
   },
 
   /**
Loading diff…
On This Page