CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25752 – Mozilla: Potential out-of-bounds when accessing throttled streams
https://notcve.org/view.php?id=CVE-2023-25752
When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code to be incorrect and vulnerable. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that when accessing throttled streams, the count of available bytes needs to be checked in the calling function to be within bounds. • https://bugzilla.mozilla.org/show_bug.cgi?id=1811627 https://www.mozilla.org/security/advisories/mfsa2023-09 https://www.mozilla.org/security/advisories/mfsa2023-10 https://www.mozilla.org/security/advisories/mfsa2023-11 https://access.redhat.com/security/cve/CVE-2023-25752 https://bugzilla.redhat.com/show_bug.cgi?id=2178460 • CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25731
https://notcve.org/view.php?id=CVE-2023-25731
Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox < 110. • https://bugzilla.mozilla.org/show_bug.cgi?id=1801542 https://www.mozilla.org/security/advisories/mfsa2023-05 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25736
https://notcve.org/view.php?id=CVE-2023-25736
An invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior. This vulnerability affects Firefox < 110. • https://bugzilla.mozilla.org/show_bug.cgi?id=1811331 https://www.mozilla.org/security/advisories/mfsa2023-05 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25733
https://notcve.org/view.php?id=CVE-2023-25733
The return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null pointer dereference. This vulnerability affects Firefox < 110. • https://bugzilla.mozilla.org/show_bug.cgi?id=1808632 https://www.mozilla.org/security/advisories/mfsa2023-05 • CWE-252: Unchecked Return Value •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25737 – Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry
https://notcve.org/view.php?id=CVE-2023-25737
An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. The Mozilla Foundation Security Advisory describes this flaw as: An invalid downcast from `nsTextNode` to `SVGElement` could have lead to undefined behavior. • https://bugzilla.mozilla.org/show_bug.cgi?id=1811464 https://www.mozilla.org/security/advisories/mfsa2023-05 https://www.mozilla.org/security/advisories/mfsa2023-06 https://www.mozilla.org/security/advisories/mfsa2023-07 https://access.redhat.com/security/cve/CVE-2023-25737 https://bugzilla.redhat.com/show_bug.cgi?id=2170379 • CWE-704: Incorrect Type Conversion or Cast •