CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-34416 – Mozilla: Memory safety bugs fixed in Firefox 114 and Firefox ESR 102.12
https://notcve.org/view.php?id=CVE-2023-34416
Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12. The Mozilla Foundation Security Advisory describes this flaw as: Mozilla developers and community members Gabriele Svelto, Andrew McCreight, the Mozilla Fuzzing Team, Sean Feng, and Sebastian Hengst reported memory safety bugs present in Firefox 113 and Firefox ESR 102.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1752703%2C1818394%2C1826875%2C1827340%2C1827655%2C1828065%2C1830190%2C1830206%2C1830795%2C1833339 https://security.gentoo.org/glsa/202312-03 https://security.gentoo.org/glsa/202401-10 https://www.mozilla.org/security/advisories/mfsa2023-19 https://www.mozilla.org/security/advisories/mfsa2023-20 https://www.mozilla.org/security/advisories/mfsa2023-21 https://access.redhat.com/security/cve/CVE-2023-34416 https://bugzilla.redhat.com/show_bug.cgi?id=2212842 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34417
https://notcve.org/view.php?id=CVE-2023-34417
Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 114. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1746447%2C1820903%2C1832832 https://security.gentoo.org/glsa/202401-10 https://www.mozilla.org/security/advisories/mfsa2023-20 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23600
https://notcve.org/view.php?id=CVE-2023-23600
Per origin notification permissions were being stored in a way that didn't take into account what browsing context the permission was granted in. This lead to the possibility of notifications to be displayed during different browsing sessions.<br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 109. • https://bugzilla.mozilla.org/show_bug.cgi?id=1787034 https://www.mozilla.org/security/advisories/mfsa2023-01 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-25741
https://notcve.org/view.php?id=CVE-2023-25741
When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipped in 109 and caused web compatibility problems as well as this security concern, so the behavior was disabled until further review. This vulnerability affects Firefox < 110. • https://bugzilla.mozilla.org/show_bug.cgi?id=1437126 https://bugzilla.mozilla.org/show_bug.cgi?id=1812611 https://bugzilla.mozilla.org/show_bug.cgi?id=1813376 https://www.mozilla.org/security/advisories/mfsa2023-05 •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25745
https://notcve.org/view.php?id=CVE-2023-25745
Memory safety bugs present in Firefox 109. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 110. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1688592%2C1797186%2C1804998%2C1806521%2C1813284 https://www.mozilla.org/security/advisories/mfsa2023-05 • CWE-787: Out-of-bounds Write •