CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25752 – Mozilla: Potential out-of-bounds when accessing throttled streams
https://notcve.org/view.php?id=CVE-2023-25752
When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code to be incorrect and vulnerable. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that when accessing throttled streams, the count of available bytes needs to be checked in the calling function to be within bounds. • https://bugzilla.mozilla.org/show_bug.cgi?id=1811627 https://www.mozilla.org/security/advisories/mfsa2023-09 https://www.mozilla.org/security/advisories/mfsa2023-10 https://www.mozilla.org/security/advisories/mfsa2023-11 https://access.redhat.com/security/cve/CVE-2023-25752 https://bugzilla.redhat.com/show_bug.cgi?id=2178460 • CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25731
https://notcve.org/view.php?id=CVE-2023-25731
Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox < 110. • https://bugzilla.mozilla.org/show_bug.cgi?id=1801542 https://www.mozilla.org/security/advisories/mfsa2023-05 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25736
https://notcve.org/view.php?id=CVE-2023-25736
An invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior. This vulnerability affects Firefox < 110. • https://bugzilla.mozilla.org/show_bug.cgi?id=1811331 https://www.mozilla.org/security/advisories/mfsa2023-05 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25733
https://notcve.org/view.php?id=CVE-2023-25733
The return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null pointer dereference. This vulnerability affects Firefox < 110. • https://bugzilla.mozilla.org/show_bug.cgi?id=1808632 https://www.mozilla.org/security/advisories/mfsa2023-05 • CWE-252: Unchecked Return Value •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25739 – Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext
https://notcve.org/view.php?id=CVE-2023-25739
Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoadContext</code>. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. The Mozilla Foundation Security Advisory describes this flaw as: Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in `ScriptLoadContext`. • https://bugzilla.mozilla.org/show_bug.cgi?id=1811939 https://www.mozilla.org/security/advisories/mfsa2023-05 https://www.mozilla.org/security/advisories/mfsa2023-06 https://www.mozilla.org/security/advisories/mfsa2023-07 https://access.redhat.com/security/cve/CVE-2023-25739 https://bugzilla.redhat.com/show_bug.cgi?id=2170381 • CWE-416: Use After Free •