CVE-2023-25738: Medium severity thunderbird vulnerability
Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables.<br>This bug only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.
Other sources
Members of the DEVMODEW struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables.This bug only affects Firefox on Windows. Other operating systems are unaffected.
— Mozilla
Members of the DEVMODEW struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables.This bug only affects Thunderbird on Windows. Other operating systems are unaffected.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2023-25738?
CVE-2023-25738 is a vulnerability that affects Firefox on Windows, allowing for out-of-bounds access to variables due to invalid values in the DEVMODEW struct set by the printer device driver.
How does CVE-2023-25738 impact users?
CVE-2023-25738 may lead to browser crashes, arbitrary code execution, or potential exploitation of other vulnerabilities.
Which versions of Firefox are affected by CVE-2023-25738?
Firefox versions up to and excluding 110 are affected by CVE-2023-25738.
How can I fix CVE-2023-25738?
Update your Firefox browser to version 110 or higher to address CVE-2023-25738.
Where can I find more information about CVE-2023-25738?
You can find more information about CVE-2023-25738 on the Mozilla Security Advisories: MFSA2023-05 and MFSA2023-07, as well as the bug report on Bugzilla.