CVE-2023-25746: High severity Mozilla Thunderbird vulnerability

Q: What is CVE-2023-25746?

CVE-2023-25746 is a vulnerability that involves memory safety bugs present in Thunderbird and Firefox ESR, which could be exploited to run arbitrary code.

Q: How severe is CVE-2023-25746?

CVE-2023-25746 has a severity score of 8.8 (high).

Q: Which software versions are affected by CVE-2023-25746?

Versions up to exclusive 102.8 of Thunderbird, Firefox ESR 102.8, and specific versions of Red Hat, Ubuntu, and Debian packages are affected by CVE-2023-25746.

Q: Where can I find more information about CVE-2023-25746?

You can find more information about CVE-2023-25746 in the Bugzilla and Mozilla security advisories links provided in the references.

Q: What is the Common Weakness Enumeration (CWE) related to CVE-2023-25746?

The CWE related to CVE-2023-25746 is CWE-120 (Buffer Copy without Checking Size of Input).

Published Feb 14, 2023

Updated

Last updated 24 July 2024

Other sources

Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 102.8 and Firefox ESR < 102.8.

Mozilla developers Philipp and Gabriele Svelto reported memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

— Mozilla

Mozilla developers Philipp and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Affected Software

30 affected componentsFixes available

redhat/firefox<0:102.8.0-2.el7_9

0:102.8.0-2.el7_9

redhat/thunderbird<0:102.8.0-2.el7_9

0:102.8.0-2.el7_9

redhat/firefox<0:102.8.0-2.el8_7

0:102.8.0-2.el8_7

redhat/thunderbird<0:102.8.0-2.el8_7

0:102.8.0-2.el8_7

redhat/firefox<0:102.8.0-2.el8_1

0:102.8.0-2.el8_1

redhat/thunderbird<0:102.8.0-2.el8_1

0:102.8.0-2.el8_1

redhat/firefox<0:102.8.0-2.el8_2

0:102.8.0-2.el8_2

redhat/thunderbird<0:102.8.0-2.el8_2

0:102.8.0-2.el8_2

redhat/firefox<0:102.8.0-2.el8_4

0:102.8.0-2.el8_4

redhat/thunderbird<0:102.8.0-2.el8_4

0:102.8.0-2.el8_4

redhat/firefox<0:102.8.0-2.el8_6

0:102.8.0-2.el8_6

redhat/thunderbird<0:102.8.0-2.el8_6

0:102.8.0-2.el8_6

redhat/firefox<0:102.8.0-2.el9_1

0:102.8.0-2.el9_1

redhat/thunderbird<0:102.8.0-2.el9_1

0:102.8.0-2.el9_1

redhat/firefox<0:102.8.0-2.el9_0

0:102.8.0-2.el9_0

redhat/thunderbird<0:102.8.0-2.el9_0

0:102.8.0-2.el9_0

redhat/firefox<102.8

102.8

redhat/thunderbird<102.8

102.8

Mozilla Thunderbird<102.8

102.8

Mozilla Firefox ESR<102.8

Mozilla Thunderbird<102.8

Mozilla Firefox ESR<102.8

102.8

debian/firefox-esr

140.12.0esr-1~deb12u1153.6.0esr-1~deb12u2140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.6.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u21:140.12.0esr-1~deb13u11:153.6.0esr-1~deb13u11:153.5.0esr-11:153.6.0esr-1

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

alpine/firefox-esr<102.8.0-r0

102.8.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el7_9
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el7_9
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_7
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_7
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_1
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_1
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_2
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_2
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_4
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_4
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_6
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el8_6
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el9_1
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el9_1
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el9_0
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 0:102.8.0-2.el9_0
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 102.8
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 102.8
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.14.0esr-1~deb11u1Fixed in 128.3.1esr-1~deb11u1Fixed in 115.14.0esr-1~deb12u1Fixed in 128.3.1esr-1~deb12u1Fixed in 128.3.0esr-2Fixed in 128.3.1esr-2
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.12.0-1~deb11u1Fixed in 1:115.16.0esr-1~deb11u1Fixed in 1:115.12.0-1~deb12u1Fixed in 1:115.16.0esr-1~deb12u1Fixed in 1:128.2.0esr-1Fixed in 1:128.3.0esr-1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 102.8
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 102.8

Event History

Feb 14, 2023

CVE Published

via Mozilla·12:00 AM

Jun 2, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

05:15 PM

Description

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·05:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2023-25746?

CVE-2023-25746 is a vulnerability that involves memory safety bugs present in Thunderbird and Firefox ESR, which could be exploited to run arbitrary code.

How severe is CVE-2023-25746?

CVE-2023-25746 has a severity score of 8.8 (high).

Which software versions are affected by CVE-2023-25746?

Versions up to exclusive 102.8 of Thunderbird, Firefox ESR 102.8, and specific versions of Red Hat, Ubuntu, and Debian packages are affected by CVE-2023-25746.

Where can I find more information about CVE-2023-25746?

You can find more information about CVE-2023-25746 in the Bugzilla and Mozilla security advisories links provided in the references.

What is the Common Weakness Enumeration (CWE) related to CVE-2023-25746?

The CWE related to CVE-2023-25746 is CWE-120 (Buffer Copy without Checking Size of Input).

CVE-2023-25746: High severity Mozilla Thunderbird vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is CVE-2023-25746?

How severe is CVE-2023-25746?

Which software versions are affected by CVE-2023-25746?

Where can I find more information about CVE-2023-25746?

What is the Common Weakness Enumeration (CWE) related to CVE-2023-25746?

Company

Resources

Contact