Log in Start free

Vulnerability · Published Jun 2, 2023 · Assigned by mozilla

CVE-2023-32215

High 8.8

In plain English

A high-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High
Exploit odds (30 days)0.8%top 44.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8firefox102.11.0-2.el8_7.almaALSA-2023:3220
AlmaLinux:9firefox102.11.0-2.el9_2.almaALSA-2023:3143
AlmaLinux:9firefox-x11102.11.0-2.el9_2.almaALSA-2023:3143
AlmaLinux:8thunderbird102.11.0-1.el8_7.almaALSA-2023:3221
AlmaLinux:9thunderbird102.11.0-1.el9_2.almaALSA-2023:3150
Alpine:v3.20firefox-esr102.11.0-r0ALPINE-CVE-2023-32215
Alpine:v3.21firefox-esr102.11.0-r0ALPINE-CVE-2023-32215
Alpine:v3.22firefox-esr102.11.0-r0ALPINE-CVE-2023-32215
Alpine:v3.23firefox-esr102.11.0-r0ALPINE-CVE-2023-32215
Debian:12firefox-esr102.11.0esr-1DEBIAN-CVE-2023-32215
Debian:13firefox-esr102.11.0esr-1DEBIAN-CVE-2023-32215
Debian:14firefox-esr102.11.0esr-1DEBIAN-CVE-2023-32215
Debian:12thunderbird1:102.11.0-1DEBIAN-CVE-2023-32215
Debian:13thunderbird1:102.11.0-1DEBIAN-CVE-2023-32215
Debian:14thunderbird1:102.11.0-1DEBIAN-CVE-2023-32215
Rocky Linux:8firefox0:102.11.0-2.el8_7RLSA-2023:3220
Rocky Linux:8thunderbird0:102.11.0-1.el8_7RLSA-2023:3221
Ubuntu:22.04:LTSmozjs102102.11.0-0ubuntu0.22.04.1USN-6120-1
Ubuntu:22.04:LTSmozjs102102.11.0-0ubuntu0.22.04.1UBUNTU-CVE-2023-32215
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2023-32215
Ubuntu:22.04:LTSmozjs91no fix listedUBUNTU-CVE-2023-32215
Ubuntu:22.04:LTSthunderbird1:102.11.0+build1-0ubuntu0.22.04.1UBUNTU-CVE-2023-32215
Ubuntu:22.04:LTSthunderbird1:102.11.0+build1-0ubuntu0.22.04.1USN-6075-1

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 113
Mozilla Firefox ESR unspecified – before 102.11
Mozilla Thunderbird unspecified – before 102.11

References