CVE-2023-29539: Null Pointer Dereference

Q: What is CVE-2023-29539?

CVE-2023-29539 is a vulnerability that affects Firefox and Thunderbird, allowing for reflected file download attacks potentially tricking users to install malware.

Q: Which software versions are affected by CVE-2023-29539?

Firefox versions less than 112, Thunderbird versions less than 102.10, and some Ubuntu and Debian packages are affected.

Q: What is the severity of CVE-2023-29539?

CVE-2023-29539 has a severity level of medium.

Q: How can I fix CVE-2023-29539?

To fix CVE-2023-29539, update your Firefox or Thunderbird to version 112 or higher, and update any affected Ubuntu or Debian packages to the recommended versions.

Q: Where can I find more information about CVE-2023-29539?

You can find more information about CVE-2023-29539 on the Mozilla website and the Bugzilla page.

Published Apr 11, 2023

Updated

Last updated 24 July 2024

Other sources

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.

Affected Software

16 affected componentsFixes available

debian/firefox

131.0-1

debian/firefox-esr

115.14.0esr-1~deb11u1128.3.0esr-1~deb11u2115.14.0esr-1~deb12u1128.3.0esr-1~deb12u1115.15.0esr-1128.3.0esr-2

debian/thunderbird

1:115.12.0-1~deb11u11:115.15.0-1~deb11u11:115.12.0-1~deb12u11:115.15.0-1~deb12u11:128.2.0esr-11:128.3.0esr-1

Mozilla Thunderbird<102.10

102.10

Mozilla Firefox<112.0

Mozilla Firefox Android<112.0

Mozilla Firefox ESR<102.10

Mozilla Focus Android<112.0

Mozilla Thunderbird<102.10

Mozilla Firefox ESR<102.10

102.10

Mozilla Firefox<112

112

All of the following

Mozilla Firefox=112

Google Android

All of the following

Mozilla Focus=112

Google Android

Mozilla Firefox Mobile Android<112.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 131.0-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.14.0esr-1~deb11u1Fixed in 128.3.0esr-1~deb11u2Fixed in 115.14.0esr-1~deb12u1Fixed in 128.3.0esr-1~deb12u1Fixed in 115.15.0esr-1Fixed in 128.3.0esr-2
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.12.0-1~deb11u1Fixed in 1:115.15.0-1~deb11u1Fixed in 1:115.12.0-1~deb12u1Fixed in 1:115.15.0-1~deb12u1Fixed in 1:128.2.0esr-1Fixed in 1:128.3.0esr-1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 102.10
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 102.10
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 112
Upgrade
Upgrade Mozilla Firefox to a version that resolves this vulnerability.
Fixed in 112
Upgrade
Upgrade Mozilla Firefox ESR to a version that resolves this vulnerability.
Fixed in 102.10
Upgrade
Upgrade Mozilla Focus for Android to a version that resolves this vulnerability.
Fixed in 112
Upgrade
Upgrade Mozilla Firefox for Android to a version that resolves this vulnerability.
Fixed in 112
Upgrade
Upgrade Mozilla Thunderbird to a version that resolves this vulnerability.
Fixed in 102.10

Event History

Apr 11, 2023

CVE Published

via Mozilla·12:00 AM

Jun 2, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

05:15 PM

Description

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Jan 12, 2024

Data Sourced

via Launchpad·12:18 AM

Description

Sep 16, 2024

Data Sourced

via Ubuntu·02:41 AM

RemedyDescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2023-29539?

CVE-2023-29539 is a vulnerability that affects Firefox and Thunderbird, allowing for reflected file download attacks potentially tricking users to install malware.

Which software versions are affected by CVE-2023-29539?

Firefox versions less than 112, Thunderbird versions less than 102.10, and some Ubuntu and Debian packages are affected.

What is the severity of CVE-2023-29539?

CVE-2023-29539 has a severity level of medium.

How can I fix CVE-2023-29539?

To fix CVE-2023-29539, update your Firefox or Thunderbird to version 112 or higher, and update any affected Ubuntu or Debian packages to the recommended versions.

Where can I find more information about CVE-2023-29539?

You can find more information about CVE-2023-29539 on the Mozilla website and the Bugzilla page.

CVE-2023-29539: Null Pointer Dereference

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is CVE-2023-29539?

Which software versions are affected by CVE-2023-29539?

What is the severity of CVE-2023-29539?

How can I fix CVE-2023-29539?

Where can I find more information about CVE-2023-29539?

Company

Resources

Contact