Paper/Archive/CVE-2023-4056

CVE-2023-4056

Mozilla Firefox — Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13.

EPSS 0.9%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 61.2.612 × 2012.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

Affected

ProductAffectedFixed inSource

Firefoxunspecified – < 116116CNA

Firefox ESRunspecified – < 102.14102.14CNA

Firefox ESRunspecified – < 115.1115.1CNA

firefox< 116116CISA-ADP

firefox_esr< 102.14102.14CISA-ADP

firefox_esr< 115.1115.1CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/buglist.cgi?bug_id=1820587%2C1824634%2C1839235%2C1842325%2C1843847 refmozilla.org/security/advisories/mfsa2023-29 refmozilla.org/security/advisories/mfsa2023-30 refmozilla.org/security/advisories/mfsa2023-31 refdebian.org/security/2023/dsa-5464 refdebian.org/security/2023/dsa-5469 reflists.debian.org/debian-lts-announce/2023/08/msg00008.html reflists.debian.org/debian-lts-announce/2023/08/msg00010.html