Lucene search

K
cvelistMozillaCVELIST:CVE-2023-25735
HistoryJun 02, 2023 - 12:00 a.m.

CVE-2023-25735

2023-06-0200:00:00
mozilla
www.cve.org
cross-compartment wrappers
scripted proxy
use-after-free
firefox
thunderbird
firefox esr

8.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.7%

Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

CNA Affected

[
  {
    "vendor": "Mozilla",
    "product": "Firefox",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "110",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Mozilla",
    "product": "Thunderbird",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "102.8",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Mozilla",
    "product": "Firefox ESR",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "102.8",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]