Vulnerability · Published Jun 2, 2023 · Assigned by mozilla
CVE-2023-25738
Medium 6.5
In plain English
A medium-severity out-of-bounds read in Firefox from Mozilla. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | firefox-esr | 102.8.0-r0 | ALPINE-CVE-2023-25738 |
| Alpine:v3.21 | firefox-esr | 102.8.0-r0 | ALPINE-CVE-2023-25738 |
| Alpine:v3.22 | firefox-esr | 102.8.0-r0 | ALPINE-CVE-2023-25738 |
| Alpine:v3.23 | firefox-esr | 102.8.0-r0 | ALPINE-CVE-2023-25738 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | unspecified – before 110 |
| Mozilla | Thunderbird | unspecified – before 102.8 |
| Mozilla | Firefox ESR | unspecified – before 102.8 |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H