CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-4577 – Mozilla: Memory corruption in JIT UpdateRegExpStatics
https://notcve.org/view.php?id=CVE-2023-4577
When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Cuando `UpdateRegExpStatics` intentó acceder a `initialStringHeap`, es posible que ya se haya recolectado basura antes de ingresar a la función, lo que podría haber provocado un bloqueo explotable. Esta vulnerabilidad afecta a Firefox < 117, Firefox ESR < 115.2 y Thunderbird < 115.2. The Mozilla Foundation Security Advisory describes this flaw as: When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. • https://bugzilla.mozilla.org/show_bug.cgi?id=1847397 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4577 https://bugzilla.redhat.com/show_bug.cgi?id=2236075 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-4574 – Mozilla: Memory corruption in IPC ColorPickerShownCallback
https://notcve.org/view.php?id=CVE-2023-4574
When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Al crear una devolución de llamada a través de IPC para mostrar la ventana Color Picker, se podrían haber creado varias devoluciones de llamada iguales a la vez y eventualmente todas destruidas simultáneamente tan pronto como finalice una de las devoluciones de llamada. Esto podría haber llevado a un uso después de la liberación que provocó un bloqueo potencialmente explotable. • https://bugzilla.mozilla.org/show_bug.cgi?id=1846688 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-35 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-37 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4574 https://bugzilla.redhat.com/show_bug.cgi?id=2236072 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-4578 – Mozilla: Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
https://notcve.org/view.php?id=CVE-2023-4578
When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Al llamar a `JS::CheckRegExpSyntax`, se podría haber establecido un error de sintaxis que terminaría llamando a `convertToRuntimeErrorAndClear`. Una ruta en la función podría intentar asignar memoria cuando no hay ninguna disponible, lo que habría provocado que una excepción de Falta de Memoria recién creada se manejara incorrectamente como un Error de Sintaxis. • https://bugzilla.mozilla.org/show_bug.cgi?id=1839007 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4578 https://bugzilla.redhat.com/show_bug.cgi?id=2236077 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-4573 – Mozilla: Memory corruption in IPC CanvasTranslator
https://notcve.org/view.php?id=CVE-2023-4573
When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Al recibir datos de representación a través de IPC, `mStream` podría haberse destruido al inicializarse, lo que podría haber dado lugar a un uso después de la liberación que provocaría un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2 y Thunderbird < 115.2. The Mozilla Foundation Security Advisory describes this flaw as: When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. • https://bugzilla.mozilla.org/show_bug.cgi?id=1846687 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-35 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-37 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4573 https://bugzilla.redhat.com/show_bug.cgi?id=2236071 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-4583 – Mozilla: Browsing Context potentially not cleared when closing Private Window
https://notcve.org/view.php?id=CVE-2023-4583
When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Al comprobar si el contexto de navegación se había descartado en `HttpBaseChannel`, si el grupo de carga no estaba disponible, se suponía que ya se había descartado, lo que no siempre era el caso para los canales privados después de que finalizaba la sesión privada. Esta vulnerabilidad afecta a Firefox < 117, Firefox ESR < 115.2 y Thunderbird < 115.2. The Mozilla Foundation Security Advisory describes this flaw as: When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. • https://bugzilla.mozilla.org/show_bug.cgi?id=1842030 https://www.mozilla.org/security/advisories/mfsa2023-34 https://www.mozilla.org/security/advisories/mfsa2023-36 https://www.mozilla.org/security/advisories/mfsa2023-38 https://access.redhat.com/security/cve/CVE-2023-4583 https://bugzilla.redhat.com/show_bug.cgi?id=2236082 • CWE-179: Incorrect Behavior Order: Early Validation CWE-754: Improper Check for Unusual or Exceptional Conditions •