CVE-2023-25735: Use After Free
Published Feb 14, 2023
·Updated
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy.
Affected Software
27 affected componentsFixes available
redhat/firefox<0:102.8.0-2.el7_9
0:102.8.0-2.el7_9
redhat/thunderbird<0:102.8.0-2.el7_9
0:102.8.0-2.el7_9
redhat/firefox<0:102.8.0-2.el8_7
0:102.8.0-2.el8_7
redhat/thunderbird<0:102.8.0-2.el8_7
0:102.8.0-2.el8_7
redhat/firefox<0:102.8.0-2.el8_1
0:102.8.0-2.el8_1
redhat/thunderbird<0:102.8.0-2.el8_1
0:102.8.0-2.el8_1
redhat/firefox<0:102.8.0-2.el8_2
0:102.8.0-2.el8_2
redhat/thunderbird<0:102.8.0-2.el8_2
0:102.8.0-2.el8_2
redhat/firefox<0:102.8.0-2.el8_4
0:102.8.0-2.el8_4
redhat/thunderbird<0:102.8.0-2.el8_4
0:102.8.0-2.el8_4
redhat/firefox<0:102.8.0-2.el8_6
0:102.8.0-2.el8_6
redhat/thunderbird<0:102.8.0-2.el8_6
0:102.8.0-2.el8_6
redhat/firefox<0:102.8.0-2.el9_1
0:102.8.0-2.el9_1
redhat/thunderbird<0:102.8.0-2.el9_1
0:102.8.0-2.el9_1
redhat/firefox<0:102.8.0-2.el9_0
0:102.8.0-2.el9_0
redhat/thunderbird<0:102.8.0-2.el9_0
0:102.8.0-2.el9_0
redhat/firefox<102.8
102.8
redhat/thunderbird<102.8
102.8
debian/firefox
131.0.2-2
debian/firefox-esr
115.14.0esr-1~deb11u1128.3.1esr-1~deb11u1115.14.0esr-1~deb12u1128.3.1esr-1~deb12u1128.3.0esr-2128.3.1esr-2
debian/thunderbird
1:115.12.0-1~deb11u11:115.16.0esr-1~deb11u11:115.12.0-1~deb12u11:115.16.0esr-1~deb12u11:128.2.0esr-11:128.3.0esr-1
Mozilla Thunderbird<102.8
102.8
Mozilla Firefox<110.0
Mozilla Firefox ESR<102.8
Mozilla Thunderbird<102.8
Mozilla Firefox<110
110
Mozilla Firefox ESR<102.8
102.8
Event History
Feb 14, 2023
CVE Published
12:00 AM
Jun 2, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
05:15 PM
Description
Jan 12, 2024
Data Sourced
via Launchpad·12:17 AM
Description
Sep 16, 2024
Data Sourced
via Ubuntu·02:41 AM
RemedyDescriptionSeverityAffected Software
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-25735.
2
Which software is affected by this vulnerability?
This vulnerability affects Mozilla Firefox, Thunderbird, and Firefox ESR.
3
What is the severity of CVE-2023-25735?
The severity of CVE-2023-25735 is high with a CVSS score of 8.8.
4
How can I fix CVE-2023-25735?
To fix CVE-2023-25735, it is recommended to update Firefox, Thunderbird, and Firefox ESR to the latest version.
5
Where can I find more information about CVE-2023-25735?
You can find more information about CVE-2023-25735 on the Mozilla Bugzilla and Mozilla Security Advisories websites.