CVE-2023-29548

2023-06-0217:15:12

[email protected]

web.nvd.nist.gov

vulnerability

arm64

ion compiler

firefox

focus

android

thunderbird

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

41.6%

JSON

A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

Affected configurations

Nvd

Node

mozillafirefoxRange<112.0

mozillafirefoxRange<112.0android

mozillafirefox_esrRange<102.10

mozillafocusRange<112.0android

mozillathunderbirdRange<102.10

VendorProductVersionCPE
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:*
mozillafirefox_esr*cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
mozillafocus*cpe:2.3:a:mozilla:focus:*:*:*:*:*:android:*:*
mozillathunderbird*cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox	*	cpe:2.3:a:mozilla:firefox::::::::
mozilla	firefox	*	cpe:2.3:a:mozilla:firefox::::::android::*
mozilla	firefox_esr	*	cpe:2.3:a:mozilla:firefox_esr::::::::
mozilla	focus	*	cpe:2.3:a:mozilla:focus::::::android::*
mozilla	thunderbird	*	cpe:2.3:a:mozilla:thunderbird::::::::