Lucene search

K
ubuntucveUbuntu.comUB:CVE-2023-4578
HistoryAug 30, 2023 - 12:00 a.m.

CVE-2023-4578

2023-08-3000:00:00
ubuntu.com
ubuntu.com
10
cve-2023-4578
firefox
thunderbird
syntax error
js::checkregexpsyntax
out of memory
vulnerability
memory allocation

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

23.1%

When calling JS::CheckRegExpSyntax a Syntax Error could have been set
which would end in calling convertToRuntimeErrorAndClear. A path in the
function could attempt to allocate memory when none is available which
would have caused a newly created Out of Memory exception to be mishandled
as a Syntax Error. This vulnerability affects Firefox < 117, Firefox ESR <
115.2, and Thunderbird < 115.2.

Notes

Author Note
tyhicks mozjs contains a copy of the SpiderMonkey JavaScript engine
mdeslaur starting with Ubuntu 22.04, the firefox package is just a script that installs the Firefox snap

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

23.1%