CVE-2023-0767: Buffer Overflow

Q: What is CVE-2023-0767?

CVE-2023-0767 is a vulnerability that allows an attacker to construct a PKCS 12 cert bundle that could allow for arbitrary memory writes.

Q: What software is affected by CVE-2023-0767?

CVE-2023-0767 affects Firefox versions less than 110, Thunderbird versions less than 102.8, and Firefox ESR versions less than 102.8.

Q: How can an attacker exploit CVE-2023-0767?

An attacker can exploit CVE-2023-0767 by constructing a malicious PKCS 12 cert bundle that triggers mishandling of PKCS 12 Safe Bag attributes, leading to arbitrary memory writes.

Q: What is the severity of CVE-2023-0767?

CVE-2023-0767 has a severity rating of 8.8, which is considered high.

Q: Where can I find more information about CVE-2023-0767?

You can find more information about CVE-2023-0767 in the Mozilla security advisories: [Link to advisory 1](https://www.mozilla.org/security/advisories/mfsa2023-05/), [Link to advisory 2](https://www.mozilla.org/security/advisories/mfsa2023-07/).

Published Feb 14, 2023

Updated

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled.

Other sources

Mozilla Network Security Services (NSS), as used in Mozilla Firefox, could allow a remote attacker to execute arbitrary code on the system, caused by an arbitrary memory write. By constructing a PKCS 12 cert bundle in such a way, a remote attacker could exploit this vulnerability using PKCS 12 Safe Bag attributes to allow for arbitrary memory writes and execute arbitrary code on the vulnerable system.

— IBM

Affected Software

32 affected componentsFixes available

redhat/nss<0:3.44.0-13.el6_10

0:3.44.0-13.el6_10

redhat/nss<0:3.79.0-5.el7_9

0:3.79.0-5.el7_9

redhat/nss<0:3.79.0-11.el8_7

0:3.79.0-11.el8_7

redhat/nss<0:3.44.0-11.el8_1

0:3.44.0-11.el8_1

redhat/firefox<0:102.9.0-4.el8_1

0:102.9.0-4.el8_1

redhat/nss<0:3.53.1-13.el8_2

0:3.53.1-13.el8_2

redhat/nss<0:3.67.0-8.el8_4

0:3.67.0-8.el8_4

redhat/nss<0:3.79.0-11.el8_6

0:3.79.0-11.el8_6

redhat/nss<0:3.79.0-17.el9_1

0:3.79.0-17.el9_1

redhat/nss<0:3.79.0-17.el9_0

0:3.79.0-17.el9_0

IBM Cognos Analytics<=12.0.0-12.0.3

IBM Cognos Analytics<=11.2.0-11.2.4 FP4

Mozilla Thunderbird<102.8

102.8

Mozilla Firefox<110.0

Mozilla Firefox ESR<102.8

Mozilla Thunderbird<102.8

Mozilla Firefox<110

110

Mozilla Firefox ESR<102.8

102.8

redhat/firefox<102.8

102.8

redhat/thunderbird<102.8

102.8

redhat/nss<3.88.1

3.88.1

redhat/nss<3.79.4

3.79.4

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

debian/firefox

159.0.1-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.6.0esr-1~deb12u2140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.6.0esr-1

debian/nss

2:3.87.1-1+deb12u22:3.87.1-1+deb12u42:3.110-1+deb13u42:3.110-1+deb13u52:3.132-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u21:140.12.0esr-1~deb13u11:153.6.0esr-1~deb13u11:153.5.0esr-11:153.6.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/nss to a version that resolves this vulnerability.
Fixed in 0:3.44.0-13.el6_10
Upgrade
Upgrade redhat/nss to a version that resolves this vulnerability.
Fixed in 0:3.79.0-5.el7_9
Upgrade
Upgrade redhat/nss to a version that resolves this vulnerability.
Fixed in 0:3.79.0-11.el8_7
Upgrade
Upgrade redhat/nss to a version that resolves this vulnerability.
Fixed in 0:3.44.0-11.el8_1
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.9.0-4.el8_1
Upgrade
Upgrade redhat/nss to a version that resolves this vulnerability.
Fixed in 0:3.53.1-13.el8_2
Upgrade
Upgrade redhat/nss to a version that resolves this vulnerability.
Fixed in 0:3.67.0-8.el8_4
Upgrade
Upgrade redhat/nss to a version that resolves this vulnerability.
Fixed in 0:3.79.0-11.el8_6
Upgrade
Upgrade redhat/nss to a version that resolves this vulnerability.
Fixed in 0:3.79.0-17.el9_1
Upgrade
Upgrade redhat/nss to a version that resolves this vulnerability.
Fixed in 0:3.79.0-17.el9_0
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 102.8
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 110
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 102.8
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 102.8
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 102.8
Upgrade
Upgrade redhat/nss to a version that resolves this vulnerability.
Fixed in 3.88.1
Upgrade
Upgrade redhat/nss to a version that resolves this vulnerability.
Fixed in 3.79.4
Upgrade
Upgrade alpine/firefox-esr to a version that resolves this vulnerability.
Fixed in 102.8.0-r0
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 159.0.1-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1
Upgrade
Upgrade debian/nss to a version that resolves this vulnerability.
Fixed in 2:3.87.1-1+deb12u2Fixed in 2:3.87.1-1+deb12u4Fixed in 2:3.110-1+deb13u4Fixed in 2:3.110-1+deb13u5Fixed in 2:3.132-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Upgrade
Upgrade Mozilla Firefox to a version that resolves this vulnerability.
Fixed in 110
Upgrade
Upgrade Mozilla Thunderbird to a version that resolves this vulnerability.
Fixed in 102.8

Event History

Feb 14, 2023

CVE Published

via Mozilla·12:00 AM

Feb 16, 2023

Data Sourced

via Red Hat·09:09 AM

DescriptionSeverityAffected Software

Jun 2, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

05:15 PM

Description

Data Sourced

via NVD·05:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2023-0767?

CVE-2023-0767 is a vulnerability that allows an attacker to construct a PKCS 12 cert bundle that could allow for arbitrary memory writes.

What software is affected by CVE-2023-0767?

CVE-2023-0767 affects Firefox versions less than 110, Thunderbird versions less than 102.8, and Firefox ESR versions less than 102.8.

How can an attacker exploit CVE-2023-0767?

An attacker can exploit CVE-2023-0767 by constructing a malicious PKCS 12 cert bundle that triggers mishandling of PKCS 12 Safe Bag attributes, leading to arbitrary memory writes.

What is the severity of CVE-2023-0767?

CVE-2023-0767 has a severity rating of 8.8, which is considered high.

Where can I find more information about CVE-2023-0767?

You can find more information about CVE-2023-0767 in the Mozilla security advisories: [Link to advisory 1](https://www.mozilla.org/security/advisories/mfsa2023-05/), [Link to advisory 2](https://www.mozilla.org/security/advisories/mfsa2023-07/).

CVE-2023-0767: Buffer Overflow

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is CVE-2023-0767?

What software is affected by CVE-2023-0767?

How can an attacker exploit CVE-2023-0767?

What is the severity of CVE-2023-0767?

Where can I find more information about CVE-2023-0767?

Company

Resources

Contact