CVE-2023-4584 - Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2

Back Back to CVE browser

HIGH

Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2

Published Sep 11, 2023

8.8

HIGH

CVSS 3.1

EPSS 0.80%

Description

Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <117
Vendor Mozilla Product Firefox ESR Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <102.15
- Version
  unspecified
  Status
  affected
  Constraints
  <115.2
Vendor Mozilla Product Thunderbird Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <102.15
- Version
  unspecified
  Status
  affected
  Constraints
  <115.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
unspecified	affected	<117

Mozilla

Firefox ESR

n/a

Version	Status	Constraints
unspecified	affected	<102.15
unspecified	affected	<115.2

Mozilla

Thunderbird

n/a

Version	Status	Constraints
unspecified	affected	<102.15
unspecified	affected	<115.2

Red Hat Enterprise Linux 7

firefox-0:102.15.0-1.el7_9

Fixed · RHSA-2023:5019
Red Hat Enterprise Linux 7

thunderbird-0:102.15.0-1.el7_9

Fixed · RHSA-2023:4945
Red Hat Enterprise Linux 8

firefox-0:102.15.0-1.el8_8

Fixed · RHSA-2023:4952
Red Hat Enterprise Linux 8

thunderbird-0:102.15.0-1.el8_8

Fixed · RHSA-2023:4954
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

firefox-0:102.15.0-1.el8_1

Fixed · RHSA-2023:4949
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

thunderbird-0:102.15.0-1.el8_1

Fixed · RHSA-2023:4948
Red Hat Enterprise Linux 8.2 Advanced Update Support

firefox-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Advanced Update Support

thunderbird-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4946
Red Hat Enterprise Linux 8.2 Telecommunications Update Service

firefox-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Telecommunications Update Service

thunderbird-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4946
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

firefox-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

thunderbird-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4946
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

firefox-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

thunderbird-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4956
Red Hat Enterprise Linux 8.4 Telecommunications Update Service

firefox-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Telecommunications Update Service

thunderbird-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4956
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

firefox-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

thunderbird-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4956
Red Hat Enterprise Linux 8.6 Extended Update Support

firefox-0:102.15.0-1.el8_6

Fixed · RHSA-2023:4959
Red Hat Enterprise Linux 9

firefox-0:102.15.0-1.el9_2

Fixed · RHSA-2023:4958
Red Hat Enterprise Linux 9

thunderbird-0:102.15.0-1.el9_2

Fixed · RHSA-2023:4955
Red Hat Enterprise Linux 9.0 Extended Update Support

firefox-0:102.15.0-1.el9_0

Fixed · RHSA-2023:4950
Red Hat Enterprise Linux 9.0 Extended Update Support

thunderbird-0:102.15.0-1.el9_0

Fixed · RHSA-2023:4947
Red Hat Enterprise Linux 6

firefox

Out of support scope
Red Hat Enterprise Linux 6

thunderbird

Out of support scope

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	firefox-0:102.15.0-1.el7_9	Fixed	RHSA-2023:5019
Red Hat Enterprise Linux 7	thunderbird-0:102.15.0-1.el7_9	Fixed	RHSA-2023:4945
Red Hat Enterprise Linux 8	firefox-0:102.15.0-1.el8_8	Fixed	RHSA-2023:4952
Red Hat Enterprise Linux 8	thunderbird-0:102.15.0-1.el8_8	Fixed	RHSA-2023:4954
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions	firefox-0:102.15.0-1.el8_1	Fixed	RHSA-2023:4949
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions	thunderbird-0:102.15.0-1.el8_1	Fixed	RHSA-2023:4948
Red Hat Enterprise Linux 8.2 Advanced Update Support	firefox-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Advanced Update Support	thunderbird-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4946
Red Hat Enterprise Linux 8.2 Telecommunications Update Service	firefox-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Telecommunications Update Service	thunderbird-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4946
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	firefox-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	thunderbird-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4946
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	firefox-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	thunderbird-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4956
Red Hat Enterprise Linux 8.4 Telecommunications Update Service	firefox-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Telecommunications Update Service	thunderbird-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4956
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	firefox-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	thunderbird-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4956
Red Hat Enterprise Linux 8.6 Extended Update Support	firefox-0:102.15.0-1.el8_6	Fixed	RHSA-2023:4959
Red Hat Enterprise Linux 9	firefox-0:102.15.0-1.el9_2	Fixed	RHSA-2023:4958
Red Hat Enterprise Linux 9	thunderbird-0:102.15.0-1.el9_2	Fixed	RHSA-2023:4955
Red Hat Enterprise Linux 9.0 Extended Update Support	firefox-0:102.15.0-1.el9_0	Fixed	RHSA-2023:4950
Red Hat Enterprise Linux 9.0 Extended Update Support	thunderbird-0:102.15.0-1.el9_0	Fixed	RHSA-2023:4947
Red Hat Enterprise Linux 6	firefox	Out of support scope	n/a
Red Hat Enterprise Linux 6	thunderbird	Out of support scope	n/a

Remediation

Red Hat statement

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Weaknesses (2)

CWE-120

Classic Buffer Overflow

CWE-787

Out-of-bounds Write

References (11)

https://access.redhat.com/security/cve/CVE-2023-4584
Vendor Advisory
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1843968%2C1845205%2C1846080%2C1846526%2C1847529
Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=2236084
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2023-4584
https://www.cve.org/CVERecord?id=CVE-2023-4584
https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/#CVE-2023-4584
https://www.mozilla.org/security/advisories/mfsa2023-34/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-35/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-36/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-37/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-38/
Vendor Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2023-4584		Vendor Advisory
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1843968%2C1845205%2C1846080%2C1846526%2C1847529		Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=2236084		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2023-4584
https://www.cve.org/CVERecord?id=CVE-2023-4584
https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/#CVE-2023-4584
https://www.mozilla.org/security/advisories/mfsa2023-34/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-35/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-36/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-37/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-38/		Vendor Advisory