CVE-2023-4046: Medium severity Mozilla Thunderbird vulnerability

Q: What is the severity of CVE-2023-4046?

The severity of CVE-2023-4046 is high with a CVSS score of 5.3.

Q: Which software versions are affected by CVE-2023-4046?

Firefox versions < 116, Firefox ESR versions < 102.14, and Thunderbird versions < 115.1 are affected by CVE-2023-4046.

Q: How can I fix CVE-2023-4046 in Firefox?

To fix CVE-2023-4046 in Firefox, update to version 116 or higher.

Q: How can I fix CVE-2023-4046 in Firefox ESR?

To fix CVE-2023-4046 in Firefox ESR, update to version 102.14 or higher.

Q: How can I fix CVE-2023-4046 in Thunderbird?

To fix CVE-2023-4046 in Thunderbird, update to version 115.1 or higher.

Published Aug 1, 2023

Updated

In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process.

Affected Software

25 affected componentsFixes available

redhat/firefox<102.14

102.14

redhat/firefox<115.1

115.1

redhat/thunderbird<102.14

102.14

redhat/thunderbird<115.1

115.1

Mozilla Thunderbird<115.1

115.1

Mozilla Thunderbird<102.14

102.14

Mozilla Firefox<116

116

Mozilla Firefox ESR<102.14

102.14

Mozilla Firefox ESR<115.1

115.1

Mozilla Firefox<116.0

Mozilla Firefox>=102.0<102.14

Mozilla Firefox>=115.0<115.1

Debian Debian Linux=11.0

Debian Debian Linux=12.0

Mozilla Firefox ESR>=102.0<102.14

Mozilla Firefox ESR>=115.0<115.1

debian/firefox

137.0.2-1

debian/firefox-esr

115.14.0esr-1~deb11u1128.9.0esr-1~deb11u1128.8.0esr-1~deb12u1128.9.0esr-1~deb12u1128.9.0esr-2

debian/thunderbird

1:115.12.0-1~deb11u11:128.9.0esr-1~deb11u11:128.8.0esr-1~deb12u11:128.9.0esr-1~deb12u11:128.9.0esr-1

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

alpine/firefox-esr<115.1.0-r0

115.1.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 102.14
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 115.1
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 102.14
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 115.1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 115.1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 102.14
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 116
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 102.14
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.1
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 137.0.2-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.14.0esr-1~deb11u1Fixed in 128.9.0esr-1~deb11u1Fixed in 128.8.0esr-1~deb12u1Fixed in 128.9.0esr-1~deb12u1Fixed in 128.9.0esr-2
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.12.0-1~deb11u1Fixed in 1:128.9.0esr-1~deb11u1Fixed in 1:128.8.0esr-1~deb12u1Fixed in 1:128.9.0esr-1~deb12u1Fixed in 1:128.9.0esr-1

Event History

Aug 1, 2023

CVE Published

via Mozilla·12:00 AM

CVE Published

via MITRE·02:57 PM

Data Sourced

via MITRE·02:57 PM

DescriptionWeakness

Data Sourced

03:15 PM

Description

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2023-4046?

The severity of CVE-2023-4046 is high with a CVSS score of 5.3.

Which software versions are affected by CVE-2023-4046?

Firefox versions < 116, Firefox ESR versions < 102.14, and Thunderbird versions < 115.1 are affected by CVE-2023-4046.

How can I fix CVE-2023-4046 in Firefox?

To fix CVE-2023-4046 in Firefox, update to version 116 or higher.

How can I fix CVE-2023-4046 in Firefox ESR?

To fix CVE-2023-4046 in Firefox ESR, update to version 102.14 or higher.

How can I fix CVE-2023-4046 in Thunderbird?

To fix CVE-2023-4046 in Thunderbird, update to version 115.1 or higher.

CVE-2023-4046: Medium severity Mozilla Thunderbird vulnerability

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2023-4046?

Which software versions are affected by CVE-2023-4046?

How can I fix CVE-2023-4046 in Firefox?

How can I fix CVE-2023-4046 in Firefox ESR?

How can I fix CVE-2023-4046 in Thunderbird?

Company

Resources

Contact