CVE-2023-37208
First published: Tue Jul 04 2023(Updated: )
When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
Credit: security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Thunderbird | <102.13 | 102.13 |
| Mozilla Firefox ESR | <102.13 | 102.13 |
| ubuntu/firefox | <115.0-1 | 115.0-1 |
| ubuntu/firefox | <115.0+ | 115.0+ |
| ubuntu/thunderbird | <1:102.13.0+ | 1:102.13.0+ |
| ubuntu/thunderbird | <1:102.13.0+ | 1:102.13.0+ |
| ubuntu/thunderbird | <1:102.13.0+ | 1:102.13.0+ |
| ubuntu/thunderbird | <1:102.13.0+ | 1:102.13.0+ |
| redhat/firefox | <102.13 | 102.13 |
| redhat/thunderbird | <102.13 | 102.13 |
| Mozilla Firefox | <115 | 115 |
| Mozilla Firefox | <115.0 | |
| Mozilla Firefox ESR | <102.13 | |
| Mozilla Thunderbird | <102.13 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| Debian Debian Linux | =12.0 | |
| debian/firefox | 123.0-1 | |
| debian/firefox-esr | <=91.12.0esr-1~deb10u1 | 115.8.0esr-1~deb10u1 115.7.0esr-1~deb11u1 115.8.0esr-1~deb11u1 115.7.0esr-1~deb12u1 115.8.0esr-1~deb12u1 115.8.0esr-1 |
| debian/thunderbird | <=1:91.12.0-1~deb10u1 | 1:115.8.0-1~deb10u1 1:115.7.0-1~deb11u1 1:115.8.0-1~deb11u1 1:115.7.0-1~deb12u1 1:115.8.0-1~deb12u1 1:115.7.0-1 1:115.8.1-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1837675
- https://www.mozilla.org/security/advisories/mfsa2023-22/
- https://www.mozilla.org/security/advisories/mfsa2023-23/
- https://www.mozilla.org/security/advisories/mfsa2023-24/
- https://lists.debian.org/debian-lts-announce/2023/07/msg00006.html
- https://lists.debian.org/debian-lts-announce/2023/07/msg00015.html
- https://www.debian.org/security/2023/dsa-5450
- https://www.debian.org/security/2023/dsa-5451
- https://launchpad.net/bugs/cve/CVE-2023-37208
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-24/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-22/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-23/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-24/#CVE-2023-37202
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-23/#CVE-2023-37208
- https://access.redhat.com/errata/RHSA-2023:4063
- https://access.redhat.com/errata/RHSA-2023:4064
- https://access.redhat.com/errata/RHSA-2023:4062
- https://access.redhat.com/errata/RHSA-2023:4068
- https://access.redhat.com/errata/RHSA-2023:4070
- https://access.redhat.com/errata/RHSA-2023:4065
- https://access.redhat.com/errata/RHSA-2023:4067
- https://access.redhat.com/errata/RHSA-2023:4069
- https://access.redhat.com/errata/RHSA-2023:4071
- https://access.redhat.com/errata/RHSA-2023:4072
- https://access.redhat.com/errata/RHSA-2023:4073
- https://access.redhat.com/errata/RHSA-2023:4066
- https://access.redhat.com/errata/RHSA-2023:4076
- https://access.redhat.com/errata/RHSA-2023:4075
- https://access.redhat.com/errata/RHSA-2023:4074
- https://access.redhat.com/errata/RHSA-2023:4079
- https://access.redhat.com/security/cve/cve-2023-37208
- https://bugzilla.redhat.com/show_bug.cgi?id=2219750
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-22/#CVE-2023-37208
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-24/#CVE-2023-37208
- https://security-tracker.debian.org/tracker/CVE-2023-37208
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37208
- https://ubuntu.com/security/notices/USN-6201-1
- https://ubuntu.com/security/notices/USN-6214-1
- https://nvd.nist.gov/vuln/detail/CVE-2023-37208
- https://ubuntu.com/security/CVE-2023-37208
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-37208.
Which software versions are affected by this vulnerability?
This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
What is the severity level of CVE-2023-37208?
The severity level of CVE-2023-37208 is medium.
How can I fix the vulnerability in Firefox?
To fix the vulnerability in Firefox, update to version 115 or later.
How can I fix the vulnerability in Thunderbird?
To fix the vulnerability in Thunderbird, update to version 102.13 or later.
- collector/mozilla-advisory
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/references
- agent/severity
- source/Mozilla
- agent/software-canonical-lookup
- collector/usn-cve
- source/Ubuntu
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-37208
- agent/description
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- vendor/mozilla
- canonical/mozilla thunderbird
- canonical/mozilla firefox esr
- package-manager/ubuntu
- package-manager/redhat
- canonical/mozilla firefox
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- version/debian debian linux/12.0
- package-manager/debian