CVE-2023-4584: Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2

Q: What is the severity of CVE-2023-4584?

The severity of CVE-2023-4584 is high (8.8).

Q: What is the remedy for CVE-2023-4584?

Update Mozilla Thunderbird to version 102.15 or higher, or update Mozilla Firefox to version 117 or higher.

Q: Is there any evidence of memory corruption in CVE-2023-4584?

Yes, there is evidence of memory corruption in CVE-2023-4584.

Q: Is there a possibility of arbitrary code execution in CVE-2023-4584?

Yes, there is a possibility of arbitrary code execution in CVE-2023-4584.

Published Aug 29, 2023

Updated

Last updated 24 July 2024

Other sources

Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

— Mozilla

Affected Software

21 affected componentsFixes available

Mozilla Thunderbird<102.15

102.15

Mozilla Thunderbird<115.2

115.2

Mozilla Firefox<117.0

Mozilla Firefox>=115.0<115.2

Mozilla Firefox ESR<102.15

Mozilla Thunderbird<115.2

Mozilla Firefox ESR>=115.0<115.2

Mozilla Firefox<117

117

Mozilla Firefox ESR<115.2

115.2

Mozilla Firefox ESR<102.15

102.15

debian/firefox

137.0.2-1

debian/firefox-esr

115.14.0esr-1~deb11u1128.9.0esr-1~deb11u1128.8.0esr-1~deb12u1128.9.0esr-1~deb12u1128.9.0esr-2

debian/thunderbird

1:115.12.0-1~deb11u11:128.9.0esr-1~deb11u11:128.8.0esr-1~deb12u11:128.9.0esr-1~deb12u11:128.9.0esr-1

redhat/firefox<115.2

115.2

redhat/thunderbird<115.2

115.2

alpine/firefox-esr<115.2.0-r0

115.2.0-r0

alpine/firefox-esr<115.2.0-r0

115.2.0-r0

alpine/firefox-esr<115.2.0-r0

115.2.0-r0

alpine/firefox-esr<115.2.0-r0

115.2.0-r0

alpine/firefox-esr<115.2.0-r0

115.2.0-r0

alpine/firefox-esr<115.2.0-r0

115.2.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 102.15
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 115.2
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 117
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.2
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 102.15
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 137.0.2-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.14.0esr-1~deb11u1Fixed in 128.9.0esr-1~deb11u1Fixed in 128.8.0esr-1~deb12u1Fixed in 128.9.0esr-1~deb12u1Fixed in 128.9.0esr-2
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.12.0-1~deb11u1Fixed in 1:128.9.0esr-1~deb11u1Fixed in 1:128.8.0esr-1~deb12u1Fixed in 1:128.9.0esr-1~deb12u1Fixed in 1:128.9.0esr-1
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 115.2
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 115.2

Event History

Aug 29, 2023

CVE Published

via Mozilla·12:00 AM

Aug 30, 2023

Data Sourced

via Red Hat·09:47 AM

DescriptionSeverityAffected Software

Sep 11, 2023

CVE Published

via MITRE·08:02 AM

Data Sourced

via MITRE·08:02 AM

Description

Data Sourced

via NVD·09:15 AM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·09:15 AM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2023-4584?

The severity of CVE-2023-4584 is high (8.8).

Which software versions are affected by CVE-2023-4584?

Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1 are affected by CVE-2023-4584.

What is the remedy for CVE-2023-4584?

Update Mozilla Thunderbird to version 102.15 or higher, or update Mozilla Firefox to version 117 or higher.

Is there any evidence of memory corruption in CVE-2023-4584?

Yes, there is evidence of memory corruption in CVE-2023-4584.

Is there a possibility of arbitrary code execution in CVE-2023-4584?

Yes, there is a possibility of arbitrary code execution in CVE-2023-4584.

CVE-2023-4584: Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2023-4584?

Which software versions are affected by CVE-2023-4584?

What is the remedy for CVE-2023-4584?

Is there any evidence of memory corruption in CVE-2023-4584?

Is there a possibility of arbitrary code execution in CVE-2023-4584?

Company

Resources

Contact