CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-4573 – Mozilla: Memory corruption in IPC CanvasTranslator
https://notcve.org/view.php?id=CVE-2023-4573
When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Al recibir datos de representación a través de IPC, `mStream` podría haberse destruido al inicializarse, lo que podría haber dado lugar a un uso después de la liberación que provocaría un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2 y Thunderbird < 115.2. The Mozilla Foundation Security Advisory describes this flaw as: When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. • https://bugzilla.mozilla.org/show_bug.cgi?id=1846687 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-35 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-37 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4573 https://bugzilla.redhat.com/show_bug.cgi?id=2236071 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-4574 – Mozilla: Memory corruption in IPC ColorPickerShownCallback
https://notcve.org/view.php?id=CVE-2023-4574
When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Al crear una devolución de llamada a través de IPC para mostrar la ventana Color Picker, se podrían haber creado varias devoluciones de llamada iguales a la vez y eventualmente todas destruidas simultáneamente tan pronto como finalice una de las devoluciones de llamada. Esto podría haber llevado a un uso después de la liberación que provocó un bloqueo potencialmente explotable. • https://bugzilla.mozilla.org/show_bug.cgi?id=1846688 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-35 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-37 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4574 https://bugzilla.redhat.com/show_bug.cgi?id=2236072 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-4575 – Mozilla: Memory corruption in IPC FilePickerShownCallback
https://notcve.org/view.php?id=CVE-2023-4575
When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Al crear una devolución de llamada a través de IPC para mostrar la ventana File Picker, se podrían haber creado varias devoluciones de llamada iguales a la vez y eventualmente todas destruidas simultáneamente tan pronto como finalice una de las devoluciones de llamada. Esto podría haber llevado a un uso después de la liberación que provocó un bloqueo potencialmente explotable. • https://bugzilla.mozilla.org/show_bug.cgi?id=1846689 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-35 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-37 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4575 https://bugzilla.redhat.com/show_bug.cgi?id=2236073 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-4584 – Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
https://notcve.org/view.php?id=CVE-2023-4584
Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Errores de seguridad de la memoria presentes en Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14 y Thunderbird 115.1. Algunos de estos errores mostraron evidencia de corrupción de memoria y suponemos que con suficiente esfuerzo algunos de ellos podrían haberse aprovechado para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1843968%2C1845205%2C1846080%2C1846526%2C1847529 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-35 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-37 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4584 https://bugzilla.redhat.com/show_bug.cgi?id=2236084 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-4577 – Mozilla: Memory corruption in JIT UpdateRegExpStatics
https://notcve.org/view.php?id=CVE-2023-4577
When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Cuando `UpdateRegExpStatics` intentó acceder a `initialStringHeap`, es posible que ya se haya recolectado basura antes de ingresar a la función, lo que podría haber provocado un bloqueo explotable. Esta vulnerabilidad afecta a Firefox < 117, Firefox ESR < 115.2 y Thunderbird < 115.2. The Mozilla Foundation Security Advisory describes this flaw as: When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. • https://bugzilla.mozilla.org/show_bug.cgi?id=1847397 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4577 https://bugzilla.redhat.com/show_bug.cgi?id=2236075 • CWE-400: Uncontrolled Resource Consumption •