CVE-2023-25744: High severity Mozilla Firefox vulnerability

Q: What is CVE-2023-25744?

CVE-2023-25744 is a vulnerability in Firefox 109 and Firefox ESR 102.7 that allows for memory corruption and potential code execution.

Q: How severe is the vulnerability CVE-2023-25744?

The severity of CVE-2023-25744 is rated as high, with a CVSS score of 8.8.

Q: Which software versions are affected by CVE-2023-25744?

Firefox versions up to exclusive 110, Firefox ESR versions up to exclusive 102.8, and various Red Hat and Ubuntu packages are affected.

Q: How do I fix CVE-2023-25744 in Firefox?

To fix CVE-2023-25744 in Firefox, update to version 110 or higher.

Q: Where can I find additional information about CVE-2023-25744?

Additional information about CVE-2023-25744 can be found in the Mozilla Bugzilla and Mozilla security advisories.

Published Feb 14, 2023

Updated

Last updated 24 July 2024

Other sources

Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 110 and Firefox ESR < 102.8.

Mozilla developers Kershaw Chang and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Affected Software

31 affected componentsFixes available

redhat/firefox<0:102.8.0-2.el7_9

0:102.8.0-2.el7_9

redhat/thunderbird<0:102.8.0-2.el7_9

0:102.8.0-2.el7_9

redhat/firefox<0:102.8.0-2.el8_7

0:102.8.0-2.el8_7

redhat/thunderbird<0:102.8.0-2.el8_7

0:102.8.0-2.el8_7

redhat/firefox<0:102.8.0-2.el8_1

0:102.8.0-2.el8_1

redhat/thunderbird<0:102.8.0-2.el8_1

0:102.8.0-2.el8_1

redhat/firefox<0:102.8.0-2.el8_2

0:102.8.0-2.el8_2

redhat/thunderbird<0:102.8.0-2.el8_2

0:102.8.0-2.el8_2

redhat/firefox<0:102.8.0-2.el8_4

0:102.8.0-2.el8_4

redhat/thunderbird<0:102.8.0-2.el8_4

0:102.8.0-2.el8_4

redhat/firefox<0:102.8.0-2.el8_6

0:102.8.0-2.el8_6

redhat/thunderbird<0:102.8.0-2.el8_6

0:102.8.0-2.el8_6

redhat/firefox<0:102.8.0-2.el9_1

0:102.8.0-2.el9_1

redhat/thunderbird<0:102.8.0-2.el9_1

0:102.8.0-2.el9_1

redhat/firefox<0:102.8.0-2.el9_0

0:102.8.0-2.el9_0

redhat/thunderbird<0:102.8.0-2.el9_0

0:102.8.0-2.el9_0

redhat/firefox<102.8

102.8

redhat/thunderbird<102.8

102.8

Mozilla Firefox<110

110

Mozilla Firefox<110.0

Mozilla Firefox ESR<102.8

102.8

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

debian/firefox

159.0.1-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.6.0esr-1~deb12u2140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.6.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u21:140.12.0esr-1~deb13u11:153.6.0esr-1~deb13u11:153.5.0esr-11:153.6.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el7_9
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el7_9
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_7
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_7
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_1
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_1
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_2
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_2
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_4
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_4
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_6
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_6
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el9_1
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el9_1
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el9_0
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el9_0
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 102.8
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 102.8
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 110
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 102.8
Upgrade
Upgrade alpine/firefox-esr to a version that resolves this vulnerability.
Fixed in 102.8.0-r0
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 159.0.1-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1

Event History

Feb 14, 2023

CVE Published

12:00 AM

Jun 2, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

05:15 PM

Description

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·05:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2023-25744?

CVE-2023-25744 is a vulnerability in Firefox 109 and Firefox ESR 102.7 that allows for memory corruption and potential code execution.

How severe is the vulnerability CVE-2023-25744?

The severity of CVE-2023-25744 is rated as high, with a CVSS score of 8.8.

Which software versions are affected by CVE-2023-25744?

Firefox versions up to exclusive 110, Firefox ESR versions up to exclusive 102.8, and various Red Hat and Ubuntu packages are affected.

How do I fix CVE-2023-25744 in Firefox?

To fix CVE-2023-25744 in Firefox, update to version 110 or higher.

Where can I find additional information about CVE-2023-25744?

Additional information about CVE-2023-25744 can be found in the Mozilla Bugzilla and Mozilla security advisories.

CVE-2023-25744: High severity Mozilla Firefox vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is CVE-2023-25744?

How severe is the vulnerability CVE-2023-25744?

Which software versions are affected by CVE-2023-25744?

How do I fix CVE-2023-25744 in Firefox?

Where can I find additional information about CVE-2023-25744?

Company

Resources

Contact