PatchGap
Firefox · Toolkit

CVE-2024-11693

Logic Error in Toolkit
Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionThe executable file warning was not presented when downloading .library-ms files. <br>*Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*
ComponentToolkit
Bug ClassLogic Error
Tracker1921458
Fix commit31542b487332 (firefox) +5/-2
CISA KEVNot listed
CreditedMarco Bonardo
Disclosed2024-11-26

Files Changed

  • toolkit/components/reputationservice/ApplicationReputation.cpp
  • toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
  • xpcom/io/nsLocalFileCommon.cpp
  • xpcom/io/nsLocalFileCommon.h

Patch

view commit
diff --git a/toolkit/components/reputationservice/ApplicationReputation.cpp b/toolkit/components/reputationservice/ApplicationReputation.cpp
index 4100dddee47..7e956b65e36 100644
--- a/toolkit/components/reputationservice/ApplicationReputation.cpp
+++ b/toolkit/components/reputationservice/ApplicationReputation.cpp
@@ -290,6 +290,7 @@ const char* const ApplicationReputationService::kBinaryFileExtensions[] = {
     //".jse", exec // JScript
     ".ksh",  // Linux shell
     //".lha",
+    //".library-ms", exec // Windows
     //".lnk", exec // Windows
     ".local",  // Windows
     //".lpaq1",
diff --git a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
index 2db14aa7430..9e19811169d 100644
--- a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
+++ b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
@@ -121,6 +121,7 @@ static const char* const kTestFileExtensions[] = {
     ".js",                 // JavaScript script
     ".jse",                // JScript
     ".ksh",                // Linux shell
+    ".library-ms",         // Windows Library Files
     ".lnk",                // Windows
     ".local",              // Windows
     ".mad",                // MS Access
diff --git a/xpcom/io/nsLocalFileCommon.cpp b/xpcom/io/nsLocalFileCommon.cpp
index 7e9d7151c1d..15be3648a78 100644
--- a/xpcom/io/nsLocalFileCommon.cpp
+++ b/xpcom/io/nsLocalFileCommon.cpp
@@ -72,6 +72,7 @@ const char* const sExecutableExts[] = {
 #endif
   ".js",
   ".jse",
+  ".library-ms",  // Windows Library Files
   ".lnk",
   ".mad",         // Access Module Shortcut
   ".maf",         // Access
diff --git a/xpcom/io/nsLocalFileCommon.h b/xpcom/io/nsLocalFileCommon.h
index 96b7e1f06af..cebcb136094 100644
--- a/xpcom/io/nsLocalFileCommon.h
+++ b/xpcom/io/nsLocalFileCommon.h
@@ -8,9 +8,9 @@
 #define _NS_LOCAL_FILE_COMMON_H_
 
 #ifdef MOZ_ESR
-extern const char* const sExecutableExts[108];
-#else
 extern const char* const sExecutableExts[109];
+#else
+extern const char* const sExecutableExts[110];
 #endif
 
 #endif
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
index 2db14aa7430..9e19811169d 100644
--- a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
+++ b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
@@ -121,6 +121,7 @@ static const char* const kTestFileExtensions[] = {
     ".js",                 // JavaScript script
     ".jse",                // JScript
     ".ksh",                // Linux shell
+    ".library-ms",         // Windows Library Files
     ".lnk",                // Windows
     ".local",              // Windows
     ".mad",                // MS Access
Loading diff…
On This Page