CVE-2023-37202: Use After Free
First published: Tue Jul 04 2023(Updated: )
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
Credit: security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Thunderbird | <102.13 | 102.13 |
| Mozilla Firefox ESR | <102.13 | 102.13 |
| ubuntu/firefox | <115.0-1 | 115.0-1 |
| ubuntu/firefox | <115.0+ | 115.0+ |
| ubuntu/thunderbird | <1:102.13.0+ | 1:102.13.0+ |
| ubuntu/thunderbird | <1:102.13.0+ | 1:102.13.0+ |
| ubuntu/thunderbird | <1:102.13.0+ | 1:102.13.0+ |
| ubuntu/thunderbird | <1:102.13.0+ | 1:102.13.0+ |
| ubuntu/mozjs102 | <102.13.0-0ubuntu0.22.04.1 | 102.13.0-0ubuntu0.22.04.1 |
| ubuntu/mozjs102 | <102.13.0-0ubuntu0.22.10.1 | 102.13.0-0ubuntu0.22.10.1 |
| ubuntu/mozjs102 | <102.13.0-0ubuntu0.23.04.1 | 102.13.0-0ubuntu0.23.04.1 |
| redhat/firefox | <102.13 | 102.13 |
| redhat/thunderbird | <102.13 | 102.13 |
| Mozilla Firefox | <115 | 115 |
| Mozilla Firefox | <115.0 | |
| Mozilla Firefox ESR | <102.13 | |
| Mozilla Thunderbird | <102.13 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| Debian Debian Linux | =12.0 | |
| debian/firefox | 123.0-1 | |
| debian/firefox-esr | <=91.12.0esr-1~deb10u1 | 115.8.0esr-1~deb10u1 115.7.0esr-1~deb11u1 115.8.0esr-1~deb11u1 115.7.0esr-1~deb12u1 115.8.0esr-1~deb12u1 115.8.0esr-1 |
| debian/thunderbird | <=1:91.12.0-1~deb10u1 | 1:115.8.0-1~deb10u1 1:115.7.0-1~deb11u1 1:115.8.0-1~deb11u1 1:115.7.0-1~deb12u1 1:115.8.0-1~deb12u1 1:115.7.0-1 1:115.8.1-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1834711
- https://www.mozilla.org/security/advisories/mfsa2023-22/
- https://www.mozilla.org/security/advisories/mfsa2023-23/
- https://www.mozilla.org/security/advisories/mfsa2023-24/
- https://www.debian.org/security/2023/dsa-5450
- https://lists.debian.org/debian-lts-announce/2023/07/msg00006.html
- https://www.debian.org/security/2023/dsa-5451
- https://lists.debian.org/debian-lts-announce/2023/07/msg00015.html
- https://launchpad.net/bugs/cve/CVE-2023-37202
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-24/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-22/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-23/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-24/#CVE-2023-37202
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-23/#CVE-2023-37202
- https://access.redhat.com/errata/RHSA-2023:4063
- https://access.redhat.com/errata/RHSA-2023:4064
- https://access.redhat.com/errata/RHSA-2023:4062
- https://access.redhat.com/errata/RHSA-2023:4068
- https://access.redhat.com/errata/RHSA-2023:4070
- https://access.redhat.com/errata/RHSA-2023:4065
- https://access.redhat.com/errata/RHSA-2023:4067
- https://access.redhat.com/errata/RHSA-2023:4069
- https://access.redhat.com/errata/RHSA-2023:4071
- https://access.redhat.com/errata/RHSA-2023:4072
- https://access.redhat.com/errata/RHSA-2023:4073
- https://access.redhat.com/errata/RHSA-2023:4066
- https://access.redhat.com/errata/RHSA-2023:4076
- https://access.redhat.com/errata/RHSA-2023:4075
- https://access.redhat.com/errata/RHSA-2023:4074
- https://access.redhat.com/errata/RHSA-2023:4079
- https://access.redhat.com/security/cve/cve-2023-37202
- https://bugzilla.redhat.com/show_bug.cgi?id=2219748
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-22/#CVE-2023-37202
- https://security-tracker.debian.org/tracker/CVE-2023-37202
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37202
- https://ubuntu.com/security/notices/USN-6201-1
- https://ubuntu.com/security/notices/USN-6214-1
- https://ubuntu.com/security/notices/USN-6227-1
- https://nvd.nist.gov/vuln/detail/CVE-2023-37202
- https://ubuntu.com/security/CVE-2023-37202
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-37202.
Which software versions are affected by this vulnerability?
This vulnerability affects Firefox versions less than 115, Firefox ESR versions less than 102.13, and Thunderbird versions less than 102.13.
What is the severity of CVE-2023-37202?
The severity of CVE-2023-37202 is high, with a severity value of 7.
How does this vulnerability occur?
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free.
How can I find more information about CVE-2023-37202?
You can find more information about CVE-2023-37202 in the following references: [Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1834711), [Mozilla Security Advisory](https://www.mozilla.org/security/advisories/mfsa2023-22/), [Mozilla Security Advisory](https://www.mozilla.org/security/advisories/mfsa2023-23/).
- collector/mozilla-advisory
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/references
- agent/severity
- source/Mozilla
- agent/software-canonical-lookup
- collector/usn-cve
- source/Ubuntu
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-37202
- agent/description
- agent/weakness
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- vendor/mozilla
- canonical/mozilla thunderbird
- canonical/mozilla firefox esr
- package-manager/ubuntu
- package-manager/redhat
- canonical/mozilla firefox
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- version/debian debian linux/12.0
- package-manager/debian