CVE-2023-5728: Use After Free
During garbage collection extra operations were performed on a object that should not be. This could have led to a potentially exploitable crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 115.4 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.4.1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 130.0-2 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 115.15.0esr-1~deb11u1Fixed in 115.14.0esr-1~deb12u1Fixed in 115.15.0esr-1~deb12u1Fixed in 115.15.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:115.15.0-1~deb11u1Fixed in 1:115.12.0-1~deb12u1Fixed in 1:115.15.0-1~deb12u1Fixed in 1:128.2.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.4.1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 119 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.4
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2023-5728?
CVE-2023-5728 is a vulnerability in Mozilla Firefox and Firefox ESR that allows for potentially exploitable crashes due to extra operations performed on an object during garbage collection.
How severe is CVE-2023-5728?
CVE-2023-5728 has a severity level of medium.
Which software products are affected by CVE-2023-5728?
Mozilla Firefox versions up to and excluding 119 as well as Mozilla Firefox ESR versions up to and excluding 115.4 are affected by CVE-2023-5728.
How can I fix CVE-2023-5728?
To fix CVE-2023-5728, update Mozilla Firefox to version 119 or later, or update Mozilla Firefox ESR to version 115.4 or later.
Where can I find more information about CVE-2023-5728?
You can find more information about CVE-2023-5728 on the Mozilla Bugzilla page (https://bugzilla.mozilla.org/show_bug.cgi?id=1852729) and the Mozilla Security Advisories page (https://www.mozilla.org/en-US/security/advisories/mfsa2023-45/ and https://www.mozilla.org/en-US/security/advisories/mfsa2023-46/).