CVE-2023-4581
First published: Tue Aug 29 2023(Updated: )
Excel .xll add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm.
Credit: security@mozilla.org security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox ESR | <115.2 | 115.2 |
| Mozilla Thunderbird | <115.2 | 115.2 |
| Mozilla Thunderbird | <102.15 | 102.15 |
| Mozilla Firefox ESR | <102.15 | 102.15 |
| Mozilla Firefox | <117 | 117 |
| Mozilla Firefox | <117.0 | |
| Mozilla Firefox ESR | <102.15 | |
| Mozilla Firefox ESR | >=115.0<115.2 | |
| Mozilla Thunderbird | <115.2 | |
| redhat/firefox | <102.15 | 102.15 |
| redhat/thunderbird | <102.15 | 102.15 |
| redhat/firefox | <115.2 | 115.2 |
| redhat/thunderbird | <115.2 | 115.2 |
| Mozilla Firefox | >=115.0<115.2 | |
| debian/firefox | 134.0.2-2 | |
| debian/firefox-esr | 115.14.0esr-1~deb11u1 128.6.0esr-1~deb11u3 128.5.0esr-1~deb12u1 128.6.0esr-1~deb12u1 128.5.0esr-1 128.6.0esr-4 | |
| debian/thunderbird | 1:115.12.0-1~deb11u1 1:128.6.0esr-1~deb11u1 1:128.5.0esr-1~deb12u1 1:128.6.0esr-1~deb12u1 1:128.6.0esr-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1843758
- https://www.mozilla.org/security/advisories/mfsa2023-34/
- https://www.mozilla.org/security/advisories/mfsa2023-35/
- https://www.mozilla.org/security/advisories/mfsa2023-36/
- https://www.mozilla.org/security/advisories/mfsa2023-38/
- https://www.mozilla.org/security/advisories/mfsa2023-37/
- https://launchpad.net/bugs/cve/CVE-2023-4581
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-38/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-37/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-35/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-34/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/#CVE-2023-4581
- https://access.redhat.com/errata/RHSA-2023:4950
- https://access.redhat.com/errata/RHSA-2023:4947
- https://access.redhat.com/errata/RHSA-2023:4951
- https://access.redhat.com/errata/RHSA-2023:4946
- https://access.redhat.com/errata/RHSA-2023:4949
- https://access.redhat.com/errata/RHSA-2023:4948
- https://access.redhat.com/errata/RHSA-2023:4945
- https://access.redhat.com/errata/RHSA-2023:4958
- https://access.redhat.com/errata/RHSA-2023:4955
- https://access.redhat.com/errata/RHSA-2023:4959
- https://access.redhat.com/errata/RHSA-2023:4953
- https://access.redhat.com/errata/RHSA-2023:4957
- https://access.redhat.com/errata/RHSA-2023:4956
- https://access.redhat.com/errata/RHSA-2023:4952
- https://access.redhat.com/errata/RHSA-2023:4954
- https://access.redhat.com/errata/RHSA-2023:5019
- https://bugzilla.redhat.com/show_bug.cgi?id=2236080
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-34/#CVE-2023-4581
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-35/#CVE-2023-4581
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-38/#CVE-2023-4581
- https://security-tracker.debian.org/tracker/CVE-2023-4581
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4581
- https://nvd.nist.gov/vuln/detail/CVE-2023-4581
- https://ubuntu.com/security/CVE-2023-4581
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2023-4581.
Which software is affected by this vulnerability?
This vulnerability affects Firefox versions older than 117, Firefox ESR versions older than 102.15, Thunderbird versions older than 102.15, and Thunderbird versions older than 115.2.
What is the severity level of CVE-2023-4581?
The severity level of CVE-2023-4581 is medium.
How can I fix this vulnerability?
To fix this vulnerability, update Firefox to version 117 or newer, Firefox ESR to version 102.15 or newer, Thunderbird to version 102.15 or newer, and Thunderbird to version 115.2 or newer.
Where can I find more information about CVE-2023-4581?
You can find more information about CVE-2023-4581 in the following references: - [Mozilla Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1843758) - [Mozilla Security Advisory](https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/) - [Mozilla Security Advisory](https://www.mozilla.org/en-US/security/advisories/mfsa2023-37/)
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/severity
- collector/mozilla-advisory
- source/Mozilla
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-4581
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/nvd-cve
- agent/trending
- agent/tags
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/source
- vendor/mozilla
- canonical/mozilla firefox esr
- canonical/mozilla thunderbird
- canonical/mozilla firefox
- version/mozilla firefox esr/115.0
- package-manager/redhat
- version/mozilla firefox/115.0
- package-manager/debian