CVE-2023-4578: Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
Last updated 24 July 2024
Other sources
When calling JS::CheckRegExpSyntax a Syntax Error could have been set which would end in calling convertToRuntimeErrorAndClear. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error.
External Reference: https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/#CVE-2023-4578
— Red Hat
When calling JS::CheckRegExpSyntax a Syntax Error could have been set which would end in calling convertToRuntimeErrorAndClear. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
— Launchpad
When calling JS::CheckRegExpSyntax a Syntax Error could have been set which would end in calling convertToRuntimeErrorAndClear. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error.
— Mozilla
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2023-4578?
CVE-2023-4578 is a vulnerability that occurs when calling JS::CheckRegExpSyntax, which can result in a Syntax Error being set and an Out of Memory exception being mishandled.
Which software products are affected by CVE-2023-4578?
Mozilla Firefox, Mozilla Thunderbird, and some Linux distributions including Red Hat and Ubuntu are affected by CVE-2023-4578.
What is the severity of CVE-2023-4578?
The severity of CVE-2023-4578 is medium, with a CVSS score of 6.5.
How can I fix CVE-2023-4578?
To fix CVE-2023-4578, it is recommended to update your affected software to the latest version provided by the vendor.
Where can I find more information about CVE-2023-4578?
You can find more information about CVE-2023-4578 on the MITRE CVE database, Ubuntu Security Notices, and NIST NVD websites.