CVE-2023-4578: Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
Last updated 24 July 2024
Other sources
When calling JS::CheckRegExpSyntax a Syntax Error could have been set which would end in calling convertToRuntimeErrorAndClear. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error.
External Reference: https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/#CVE-2023-4578
— Red Hat
When calling JS::CheckRegExpSyntax a Syntax Error could have been set which would end in calling convertToRuntimeErrorAndClear. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
— Launchpad
When calling JS::CheckRegExpSyntax a Syntax Error could have been set which would end in calling convertToRuntimeErrorAndClear. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.2 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 117 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.2 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 138.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 128.9.0esr-1~deb11u1Fixed in 128.8.0esr-1~deb12u1Fixed in 128.10.0esr-1~deb12u1Fixed in 128.10.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:128.10.0esr-1~deb11u1Fixed in 1:128.8.0esr-1~deb12u1Fixed in 1:128.10.0esr-1~deb12u1Fixed in 1:128.10.0esr-1 - Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 115.2 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2023-4578?
CVE-2023-4578 is a vulnerability that occurs when calling JS::CheckRegExpSyntax, which can result in a Syntax Error being set and an Out of Memory exception being mishandled.
Which software products are affected by CVE-2023-4578?
Mozilla Firefox, Mozilla Thunderbird, and some Linux distributions including Red Hat and Ubuntu are affected by CVE-2023-4578.
What is the severity of CVE-2023-4578?
The severity of CVE-2023-4578 is medium, with a CVSS score of 6.5.
How can I fix CVE-2023-4578?
To fix CVE-2023-4578, it is recommended to update your affected software to the latest version provided by the vendor.
Where can I find more information about CVE-2023-4578?
You can find more information about CVE-2023-4578 on the MITRE CVE database, Ubuntu Security Notices, and NIST NVD websites.