CVE-2023-4045: Medium severity Mozilla Thunderbird vulnerability

Q: What is CVE-2023-4045?

CVE-2023-4045 is a vulnerability that affects Firefox versions below 116, Firefox ESR versions below 102.14, and Thunderbird versions below 115.1. It allows cross-origin tainting and unauthorized access to image data.

Q: How does CVE-2023-4045 impact users?

CVE-2023-4045 can be exploited to bypass same-origin policy and potentially access image data from another site.

Q: What is the severity of CVE-2023-4045?

CVE-2023-4045 has a severity rating of 5.3 (High).

Q: Which software versions are affected by CVE-2023-4045?

Firefox versions below 116, Firefox ESR versions below 102.14, and Thunderbird versions below 115.1 are affected by CVE-2023-4045.

Q: How can I mitigate the CVE-2023-4045 vulnerability?

To mitigate CVE-2023-4045, users should update their Firefox and Thunderbird installations to versions 116 and 115.1 respectively.

Published Aug 1, 2023

Updated

Last updated 24 July 2024

Other sources

Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy.

— Mozilla

Affected Software

25 affected componentsFixes available

redhat/firefox<102.14

102.14

redhat/firefox<115.1

115.1

redhat/thunderbird<102.14

102.14

redhat/thunderbird<115.1

115.1

Mozilla Thunderbird<102.14

102.14

Mozilla Thunderbird<115.1

115.1

Mozilla Firefox<116

116

Mozilla Firefox ESR<115.1

115.1

Mozilla Firefox ESR<102.14

102.14

Mozilla Firefox<116.0

Mozilla Firefox ESR>=102.0<102.14

Mozilla Firefox ESR>=115.0<115.1

Debian Debian Linux=11.0

Debian Debian Linux=12.0

debian/firefox

137.0.2-1

debian/firefox-esr

115.14.0esr-1~deb11u1128.9.0esr-1~deb11u1128.8.0esr-1~deb12u1128.9.0esr-1~deb12u1128.9.0esr-2

debian/thunderbird

1:115.12.0-1~deb11u11:128.9.0esr-1~deb11u11:128.8.0esr-1~deb12u11:128.9.0esr-1~deb12u11:128.9.0esr-1

Mozilla Firefox>=102.0<102.14

Mozilla Firefox>=115.0<115.1

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 102.14
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 115.1
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 102.14
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 115.1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 102.14
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 115.1
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 116
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.1
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 102.14
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 137.0.2-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.14.0esr-1~deb11u1Fixed in 128.9.0esr-1~deb11u1Fixed in 128.8.0esr-1~deb12u1Fixed in 128.9.0esr-1~deb12u1Fixed in 128.9.0esr-2
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.12.0-1~deb11u1Fixed in 1:128.9.0esr-1~deb11u1Fixed in 1:128.8.0esr-1~deb12u1Fixed in 1:128.9.0esr-1~deb12u1Fixed in 1:128.9.0esr-1

Event History

Aug 1, 2023

CVE Published

via Mozilla·12:00 AM

CVE Published

via MITRE·02:56 PM

Data Sourced

via MITRE·02:56 PM

DescriptionWeakness

Data Sourced

03:15 PM

Description

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2023-4045?

CVE-2023-4045 is a vulnerability that affects Firefox versions below 116, Firefox ESR versions below 102.14, and Thunderbird versions below 115.1. It allows cross-origin tainting and unauthorized access to image data.

How does CVE-2023-4045 impact users?

CVE-2023-4045 can be exploited to bypass same-origin policy and potentially access image data from another site.

What is the severity of CVE-2023-4045?

CVE-2023-4045 has a severity rating of 5.3 (High).

Which software versions are affected by CVE-2023-4045?

Firefox versions below 116, Firefox ESR versions below 102.14, and Thunderbird versions below 115.1 are affected by CVE-2023-4045.

How can I mitigate the CVE-2023-4045 vulnerability?

To mitigate CVE-2023-4045, users should update their Firefox and Thunderbird installations to versions 116 and 115.1 respectively.

CVE-2023-4045: Medium severity Mozilla Thunderbird vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is CVE-2023-4045?

How does CVE-2023-4045 impact users?

What is the severity of CVE-2023-4045?

Which software versions are affected by CVE-2023-4045?

How can I mitigate the CVE-2023-4045 vulnerability?

Company

Resources

Contact