CVE-2023-37201: Use After Free

Q: What is the severity of CVE-2023-37201?

The severity of CVE-2023-37201 is high.

Q: Which software is affected by CVE-2023-37201?

Firefox versions prior to 115, Firefox ESR versions prior to 102.13, and Thunderbird versions prior to 102.13 are affected by CVE-2023-37201.

Q: What is the impact of CVE-2023-37201?

CVE-2023-37201 could allow an attacker to trigger a use-after-free condition when creating a WebRTC connection over HTTPS.

Q: How can I fix CVE-2023-37201?

To fix CVE-2023-37201, you should update Firefox to version 115, Firefox ESR to version 102.13, or Thunderbird to version 102.13 or higher.

Published Jul 4, 2023

Updated

An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.

Other sources

An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS.

External Reference: https://www.mozilla.org/en-US/security/advisories/mfsa2023-23/#CVE-2023-37201

— Red Hat

Affected Software

26 affected componentsFixes available

ubuntu/firefox<115.0-1

115.0-1

ubuntu/firefox<115.0+

115.0+

ubuntu/thunderbird<1:102.13.0+

1:102.13.0+

ubuntu/thunderbird<1:102.13.0+

1:102.13.0+

ubuntu/thunderbird<1:102.13.0+

1:102.13.0+

ubuntu/thunderbird<1:102.13.0+

1:102.13.0+

redhat/firefox<102.13

102.13

redhat/thunderbird<102.13

102.13

debian/firefox

123.0-1

debian/firefox-esr<=91.12.0esr-1~deb10u1

115.8.0esr-1~deb10u1115.7.0esr-1~deb11u1115.8.0esr-1~deb11u1115.7.0esr-1~deb12u1115.8.0esr-1~deb12u1115.8.0esr-1

debian/thunderbird<=1:91.12.0-1~deb10u1

1:115.8.0-1~deb10u11:115.7.0-1~deb11u11:115.8.0-1~deb11u11:115.7.0-1~deb12u11:115.8.0-1~deb12u11:115.7.0-11:115.8.1-1

Mozilla Thunderbird<102.13

102.13

Mozilla Firefox<115

115

Mozilla Firefox ESR<102.13

102.13

Mozilla Firefox<115.0

Mozilla Firefox ESR<102.13

Mozilla Thunderbird<102.13

Debian Debian Linux=10.0

Debian Debian Linux=11.0

Debian Debian Linux=12.0

alpine/firefox-esr<115.0-r0

115.0-r0

alpine/firefox-esr<115.0-r0

115.0-r0

alpine/firefox-esr<115.0-r0

115.0-r0

alpine/firefox-esr<115.0-r0

115.0-r0

alpine/firefox-esr<115.0-r0

115.0-r0

alpine/firefox-esr<115.0-r0

115.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/firefox to a version that resolves this vulnerability.
Fixed in 115.0-1
Upgrade
Upgrade ubuntu/firefox to a version that resolves this vulnerability.
Fixed in 115.0+
Upgrade
Upgrade ubuntu/thunderbird to a version that resolves this vulnerability.
Fixed in 1:102.13.0+
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 102.13
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 102.13
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 123.0-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.8.0esr-1~deb10u1Fixed in 115.7.0esr-1~deb11u1Fixed in 115.8.0esr-1~deb11u1Fixed in 115.7.0esr-1~deb12u1Fixed in 115.8.0esr-1~deb12u1Fixed in 115.8.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.8.0-1~deb10u1Fixed in 1:115.7.0-1~deb11u1Fixed in 1:115.8.0-1~deb11u1Fixed in 1:115.7.0-1~deb12u1Fixed in 1:115.8.0-1~deb12u1Fixed in 1:115.7.0-1Fixed in 1:115.8.1-1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 102.13
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 115
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 102.13
Upgrade
Upgrade alpine/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.0-r0

Event History

Jul 4, 2023

CVE Published

12:00 AM

Jul 5, 2023

CVE Published

via MITRE·08:51 AM

Data Sourced

via MITRE·08:51 AM

DescriptionWeakness

Data Sourced

via NVD·09:15 AM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·09:15 AM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the vulnerability ID?

CVE-2023-37201

What is the severity of CVE-2023-37201?

The severity of CVE-2023-37201 is high.

Which software is affected by CVE-2023-37201?

Firefox versions prior to 115, Firefox ESR versions prior to 102.13, and Thunderbird versions prior to 102.13 are affected by CVE-2023-37201.

What is the impact of CVE-2023-37201?

CVE-2023-37201 could allow an attacker to trigger a use-after-free condition when creating a WebRTC connection over HTTPS.

How can I fix CVE-2023-37201?

To fix CVE-2023-37201, you should update Firefox to version 115, Firefox ESR to version 102.13, or Thunderbird to version 102.13 or higher.

CVE-2023-37201: Use After Free

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the vulnerability ID?

What is the severity of CVE-2023-37201?

Which software is affected by CVE-2023-37201?

What is the impact of CVE-2023-37201?

How can I fix CVE-2023-37201?

Company

Resources

Contact