VulnerabilityModified
CVE-2023-4057
Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
CRITICAL 9.8EPSS 0.89%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.89%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.89% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- mozilla/firefox · mozilla/firefox esr
- Source
- security@mozilla.org
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1841682Issue Tracking, Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2023-29/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-31/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-33/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1841682Issue Tracking, Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2023-29/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-31/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-33/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.