CVE-2023-4574: Memory corruption in IPC ColorPickerShownCallback
Last updated 24 July 2024
Other sources
When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash.
— Mozilla
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2023-4574?
CVE-2023-4574 is a vulnerability that allows the creation of multiple callbacks for showing the Color Picker window, leading to a use-after-free issue and potentially exploitable crashes.
Which software products are affected by CVE-2023-4574?
Mozilla Thunderbird versions up to 102.15, Mozilla Firefox versions up to 117, and Mozilla Firefox ESR versions up to 102.15 are affected by CVE-2023-4574.
Where can I find more information about CVE-2023-4574?
You can find more information about CVE-2023-4574 in the Mozilla Bugzilla report (https://bugzilla.mozilla.org/show_bug.cgi?id=1846688) and the Mozilla Security Advisories (https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/, https://www.mozilla.org/en-US/security/advisories/mfsa2023-37/).
How severe is CVE-2023-4574?
CVE-2023-4574 has a severity value of 6.5, which is considered high.
How can I fix CVE-2023-4574?
To fix CVE-2023-4574, users should update their Mozilla Thunderbird and Mozilla Firefox installations to the latest versions (Thunderbird 102.15.1+ and Firefox 117.0+).