CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25739 – Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext
https://notcve.org/view.php?id=CVE-2023-25739
Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoadContext</code>. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. The Mozilla Foundation Security Advisory describes this flaw as: Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in `ScriptLoadContext`. • https://bugzilla.mozilla.org/show_bug.cgi?id=1811939 https://www.mozilla.org/security/advisories/mfsa2023-05 https://www.mozilla.org/security/advisories/mfsa2023-06 https://www.mozilla.org/security/advisories/mfsa2023-07 https://access.redhat.com/security/cve/CVE-2023-25739 https://bugzilla.redhat.com/show_bug.cgi?id=2170381 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25742 – Mozilla: Web Crypto ImportKey crashes tab
https://notcve.org/view.php?id=CVE-2023-25742
When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. The Mozilla Foundation Security Advisory describes this flaw as: When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. • https://bugzilla.mozilla.org/show_bug.cgi?id=1813424 https://www.mozilla.org/security/advisories/mfsa2023-05 https://www.mozilla.org/security/advisories/mfsa2023-06 https://www.mozilla.org/security/advisories/mfsa2023-07 https://access.redhat.com/security/cve/CVE-2023-25742 https://bugzilla.redhat.com/show_bug.cgi?id=2170390 • CWE-173: Improper Handling of Alternate Encoding •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-25744 – Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8
https://notcve.org/view.php?id=CVE-2023-25744
Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 110 and Firefox ESR < 102.8. The Mozilla Foundation Security Advisory describes this flaw as: Mozilla developers Kershaw Chang and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1789449%2C1803628%2C1810536 https://www.mozilla.org/security/advisories/mfsa2023-05 https://www.mozilla.org/security/advisories/mfsa2023-06 https://access.redhat.com/security/cve/CVE-2023-25744 https://bugzilla.redhat.com/show_bug.cgi?id=2170391 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23597
https://notcve.org/view.php?id=CVE-2023-23597
A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the <code>file://</code> context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file read. This vulnerability affects Firefox < 109. • https://bugzilla.mozilla.org/show_bug.cgi?id=1538028 https://www.mozilla.org/security/advisories/mfsa2023-01 • CWE-326: Inadequate Encryption Strength •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23604
https://notcve.org/view.php?id=CVE-2023-23604
A duplicate <code>SystemPrincipal</code> object could be created when parsing a non-system html document via <code>DOMParser::ParseFromSafeString</code>. This could have lead to bypassing web security checks. This vulnerability affects Firefox < 109. • https://bugzilla.mozilla.org/show_bug.cgi?id=1802346 https://www.mozilla.org/security/advisories/mfsa2023-01 •