CVE-2023-28176
First published: Tue Mar 14 2023(Updated: )
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory described the issue in which Mozilla developers Timothy Nikkel, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 110 and ESR 102.8. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these could have been exploited to run arbitrary code.
Credit: security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/firefox | <0:102.9.0-3.el7_9 | 0:102.9.0-3.el7_9 |
| redhat/thunderbird | <0:102.9.0-1.el7_9 | 0:102.9.0-1.el7_9 |
| redhat/firefox | <0:102.9.0-3.el8_7 | 0:102.9.0-3.el8_7 |
| redhat/thunderbird | <0:102.9.0-1.el8_7 | 0:102.9.0-1.el8_7 |
| redhat/thunderbird | <0:102.9.0-2.el8_1 | 0:102.9.0-2.el8_1 |
| redhat/firefox | <0:102.9.0-4.el8_1 | 0:102.9.0-4.el8_1 |
| redhat/thunderbird | <0:102.9.0-2.el8_2 | 0:102.9.0-2.el8_2 |
| redhat/firefox | <0:102.9.0-4.el8_2 | 0:102.9.0-4.el8_2 |
| redhat/firefox | <0:102.9.0-4.el8_4 | 0:102.9.0-4.el8_4 |
| redhat/thunderbird | <0:102.9.0-2.el8_4 | 0:102.9.0-2.el8_4 |
| redhat/firefox | <0:102.9.0-3.el8_6 | 0:102.9.0-3.el8_6 |
| redhat/thunderbird | <0:102.9.0-1.el8_6 | 0:102.9.0-1.el8_6 |
| redhat/firefox | <0:102.9.0-3.el9_1 | 0:102.9.0-3.el9_1 |
| redhat/thunderbird | <0:102.9.0-1.el9_1 | 0:102.9.0-1.el9_1 |
| redhat/firefox | <0:102.9.0-3.el9_0 | 0:102.9.0-3.el9_0 |
| redhat/thunderbird | <0:102.9.0-1.el9_0 | 0:102.9.0-1.el9_0 |
| Mozilla Thunderbird | <102.9 | 102.9 |
| Mozilla Firefox ESR | <102.9 | 102.9 |
| redhat/firefox | <102.9 | 102.9 |
| redhat/thunderbird | <102.9 | 102.9 |
| Mozilla Firefox | <111 | 111 |
| Mozilla Firefox | <111.0 | |
| Mozilla Firefox ESR | <102.9 | |
| Mozilla Thunderbird | <102.9 | |
| ubuntu/firefox | <111.0+ | 111.0+ |
| ubuntu/firefox | <111.0+ | 111.0+ |
| ubuntu/thunderbird | <1:102.9.0+ | 1:102.9.0+ |
| ubuntu/thunderbird | <1:102.9.0+ | 1:102.9.0+ |
| ubuntu/thunderbird | <1:102.9.0+ | 1:102.9.0+ |
| ubuntu/thunderbird | <1:102.9.0+ | 1:102.9.0+ |
| debian/firefox | 129.0-1 | |
| debian/firefox-esr | 115.12.0esr-1~deb11u1 115.13.0esr-1~deb11u1 115.12.0esr-1~deb12u1 115.13.0esr-1~deb12u1 115.13.0esr-2 115.14.0esr-1 | |
| debian/thunderbird | 1:115.12.0-1~deb11u1 1:115.13.0-1~deb11u1 1:115.12.0-1~deb12u1 1:115.13.0-1~deb12u1 1:115.13.0-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.mozilla.org/security/advisories/mfsa2023-11/
- https://www.mozilla.org/security/advisories/mfsa2023-10/
- https://www.mozilla.org/security/advisories/mfsa2023-09/
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1808352%2C1811637%2C1815904%2C1817442%2C1818674
- https://www.cve.org/CVERecord?id=CVE-2023-28176 https://nvd.nist.gov/vuln/detail/CVE-2023-28176 https://www.mozilla.org/en-US/security/advisories/mfsa2023-10/#CVE-2023-28176 https://www.mozilla.org/en-US/security/advisories/mfsa2023-11/#CVE-2023-28176
- https://bugzilla.redhat.com/show_bug.cgi?id=2178472
- https://access.redhat.com/errata/RHSA-2023:1333
- https://access.redhat.com/errata/RHSA-2023:1401
- https://access.redhat.com/errata/RHSA-2023:1336
- https://access.redhat.com/errata/RHSA-2023:1403
- https://access.redhat.com/errata/RHSA-2023:1442
- https://access.redhat.com/errata/RHSA-2023:1479
- https://access.redhat.com/errata/RHSA-2023:1443
- https://access.redhat.com/errata/RHSA-2023:1445
- https://access.redhat.com/errata/RHSA-2023:1444
- https://access.redhat.com/errata/RHSA-2023:1472
- https://access.redhat.com/errata/RHSA-2023:1367
- https://access.redhat.com/errata/RHSA-2023:1404
- https://access.redhat.com/errata/RHSA-2023:1337
- https://access.redhat.com/errata/RHSA-2023:1407
- https://access.redhat.com/errata/RHSA-2023:1364
- https://access.redhat.com/errata/RHSA-2023:1402
- https://access.redhat.com/security/cve/cve-2023-28176
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-11/
- https://launchpad.net/bugs/cve/CVE-2023-28176
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-10/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-11/#CVE-2023-28164
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-10/#CVE-2023-28176
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-09/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-09/#CVE-2023-28176
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-11/#CVE-2023-28176
- https://security-tracker.debian.org/tracker/CVE-2023-28176
- https://ubuntu.com/security/notices/USN-5954-1
- https://ubuntu.com/security/notices/USN-5972-1
- https://www.cve.org/CVERecord?id=CVE-2023-28176
- https://nvd.nist.gov/vuln/detail/CVE-2023-28176
- https://ubuntu.com/security/CVE-2023-28176
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is CVE-2023-28176?
CVE-2023-28176 is a vulnerability in Mozilla that allows memory corruption.
What is the severity of CVE-2023-28176?
The severity of CVE-2023-28176 is high.
Which software is affected by CVE-2023-28176?
CVE-2023-28176 affects Mozilla Firefox (up to version 111) and Mozilla Thunderbird (up to version 102.9).
How can I fix CVE-2023-28176?
To fix CVE-2023-28176, update Mozilla Firefox to version 111 or higher, and update Mozilla Thunderbird to version 102.9 or higher.
Where can I find more information about CVE-2023-28176?
You can find more information about CVE-2023-28176 on the Mozilla Foundation Security Advisory page.
- collector/nvd-latest
- collector/redhat-cve
- collector/mozilla-advisory
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- source/Mozilla
- agent/software-canonical-lookup
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-28176
- agent/references
- agent/severity
- agent/description
- agent/weakness
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- package-manager/redhat
- vendor/mozilla
- canonical/mozilla thunderbird
- canonical/mozilla firefox esr
- canonical/mozilla firefox
- package-manager/debian
- package-manager/ubuntu