| Package | Affected versions | Patched versions |
|---|---|---|
| firefox | < 115.11.0< 126.0 | 115.11.0126.0 |
| thunderbird | < 115.11.0 | 115.11.0 |
| open-xchange appsuite frontend | = 7.10.6< 7.10.6 | 7.10.6 |
| pdfjs-dist | < 4.2.67 | 4.2.67 |
If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.
The patch removes the use of eval:
https://github.com/mozilla/pdf.js/pull/18015
Set the option isEvalSupported to false.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free