Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2023-5176 (GCVE-0-2023-5176)
Vulnerability from cvelistv5 – Published: 2023-09-27 14:13 – Updated: 2025-05-01 17:53- Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 118
(custom)
|
|
| Mozilla | Firefox ESR |
Affected:
unspecified , < 115.3
(custom)
|
|
| Mozilla | Thunderbird |
Affected:
unspecified , < 115.3
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:52:07.759Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3",
"tags": [
"x_transferred"
],
"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2023-41/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2023-42/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2023-43/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.debian.org/security/2023/dsa-5506"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.debian.org/security/2023/dsa-5513"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-5176",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T13:27:06.971475Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-01T17:53:11.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "118",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Chris Peterson, Andrew McCreight, Andr\u00e9 Bargull, Nika Layzell and the Mozilla Fuzzing Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3."
}
],
"value": "Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-09T15:06:21.738Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"name": "Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3",
"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2023-41/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2023-42/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2023-43/"
},
{
"url": "https://www.debian.org/security/2023/dsa-5506"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html"
},
{
"url": "https://www.debian.org/security/2023/dsa-5513"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2023-5176",
"datePublished": "2023-09-27T14:13:25.411Z",
"dateReserved": "2023-09-25T15:03:44.531Z",
"dateUpdated": "2025-05-01T17:53:11.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2023-5176",
"date": "2026-05-29",
"epss": "0.00704",
"percentile": "0.72404"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-5176\",\"sourceIdentifier\":\"security@mozilla.org\",\"published\":\"2023-09-27T15:19:42.767\",\"lastModified\":\"2025-05-01T18:15:52.350\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3.\"},{\"lang\":\"es\",\"value\":\"Errores de seguridad de la memoria presentes en Firefox 117, Firefox ESR 115.2 y Thunderbird 115.2. Algunos de estos errores mostraron evidencia de corrupci\u00f3n de memoria y suponemos que con suficiente esfuerzo algunos de ellos podr\u00edan haberse aprovechado para ejecutar c\u00f3digo arbitrario. Esta vulnerabilidad afecta a Firefox \u0026lt; 118, Firefox ESR \u0026lt; 115.3 y Thunderbird \u0026lt; 115.3.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"118\",\"matchCriteriaId\":\"2216A424-94E2-45E7-BB95-646BFC8182E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"115.3\",\"matchCriteriaId\":\"EED826DF-6AB2-4D04-A4FC-A90EFDCB5EB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"115.3\",\"matchCriteriaId\":\"3ED03DF1-442F-4750-84BF-8C37C606843A\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"46D69DCC-AE4D-4EA5-861C-D60951444C6C\"}]}]}],\"references\":[{\"url\":\"https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195\",\"source\":\"security@mozilla.org\",\"tags\":[\"Broken Link\",\"Issue Tracking\",\"Permissions Required\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html\",\"source\":\"security@mozilla.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html\",\"source\":\"security@mozilla.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2023/dsa-5506\",\"source\":\"security@mozilla.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2023/dsa-5513\",\"source\":\"security@mozilla.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2023-41/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2023-42/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2023-43/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Issue Tracking\",\"Permissions Required\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2023/dsa-5506\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2023/dsa-5513\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2023-41/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2023-42/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2023-43/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195\", \"name\": \"Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2023-41/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2023-42/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2023-43/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.debian.org/security/2023/dsa-5506\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.debian.org/security/2023/dsa-5513\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T07:52:07.759Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-5176\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-23T13:27:06.971475Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-01T17:50:01.080Z\"}}], \"cna\": {\"credits\": [{\"lang\": \"en\", \"value\": \"Chris Peterson, Andrew McCreight, Andr\\u00e9 Bargull, Nika Layzell and the Mozilla Fuzzing Team\"}], \"affected\": [{\"vendor\": \"Mozilla\", \"product\": \"Firefox\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"118\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Mozilla\", \"product\": \"Firefox ESR\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"115.3\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Mozilla\", \"product\": \"Thunderbird\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"115.3\", \"versionType\": \"custom\"}]}], \"references\": [{\"url\": \"https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195\", \"name\": \"Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3\"}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2023-41/\"}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2023-42/\"}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2023-43/\"}, {\"url\": \"https://www.debian.org/security/2023/dsa-5506\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html\"}, {\"url\": \"https://www.debian.org/security/2023/dsa-5513\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3\"}]}], \"providerMetadata\": {\"orgId\": \"f16b083a-5664-49f3-a51e-8d479e5ed7fe\", \"shortName\": \"mozilla\", \"dateUpdated\": \"2023-10-09T15:06:21.738Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-5176\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-01T17:53:11.846Z\", \"dateReserved\": \"2023-09-25T15:03:44.531Z\", \"assignerOrgId\": \"f16b083a-5664-49f3-a51e-8d479e5ed7fe\", \"datePublished\": \"2023-09-27T14:13:25.411Z\", \"assignerShortName\": \"mozilla\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
alsa-2023:5434
Vulnerability from osv_almalinux
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 115.3.1 ESR.
Security Fix(es):
- firefox: use-after-free in workers (CVE-2023-3600)
- Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)
- Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)
- Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3 (CVE-2023-5176)
- libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "firefox"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "115.3.1-1.el9_2.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "firefox-x11"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "115.3.1-1.el9_2.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 115.3.1 ESR.\n\nSecurity Fix(es):\n\n* firefox: use-after-free in workers (CVE-2023-3600)\n* Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)\n* Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)\n* Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3 (CVE-2023-5176)\n* libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "ALSA-2023:5434",
"modified": "2023-10-06T13:33:56Z",
"published": "2023-10-04T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2023:5434"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-3600"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-5169"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-5171"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-5176"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-5217"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2222652"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2240893"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2240894"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2240896"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2241191"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2023-5434.html"
}
],
"related": [
"CVE-2023-3600",
"CVE-2023-5169",
"CVE-2023-5171",
"CVE-2023-5176",
"CVE-2023-5217"
],
"summary": "Important: firefox security update"
}
alsa-2023:5435
Vulnerability from osv_almalinux
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 115.3.1.
Security Fix(es):
- firefox: use-after-free in workers (CVE-2023-3600)
- Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)
- Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)
- Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3 (CVE-2023-5176)
- libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
| URL | Type | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "thunderbird"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "115.3.1-1.el9_2.alma"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 115.3.1.\n\nSecurity Fix(es):\n\n* firefox: use-after-free in workers (CVE-2023-3600)\n* Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)\n* Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)\n* Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3 (CVE-2023-5176)\n* libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "ALSA-2023:5435",
"modified": "2023-10-06T13:57:07Z",
"published": "2023-10-04T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2023:5435"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-3600"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-5169"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-5171"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-5176"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2023-5217"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2222652"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2240893"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2240894"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2240896"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2241191"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2023-5435.html"
}
],
"related": [
"CVE-2023-3600",
"CVE-2023-5169",
"CVE-2023-5171",
"CVE-2023-5176",
"CVE-2023-5217"
],
"summary": "Important: thunderbird security update"
}
{
"CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Red Hat Inc., \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb, Novell Inc., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, Canonical Ltd., \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, \u0410\u041e \u00ab\u041d\u0422\u0426 \u0418\u0422 \u0420\u041e\u0421\u0410\u00bb, Mozilla Corp., \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb, \u0410\u041e \"\u041d\u041f\u041f\u041a\u0422\"",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "6 (Red Hat Enterprise Linux), 7 (Red Hat Enterprise Linux), 1.6 \u00ab\u0421\u043c\u043e\u043b\u0435\u043d\u0441\u043a\u00bb (Astra Linux Special Edition), 15.5 (OpenSUSE Leap), 8 (Red Hat Enterprise Linux), 15 SP1 (SUSE Linux Enterprise Server for SAP Applications), 12 SP5 (SUSE Linux Enterprise Server for SAP Applications), 12 SP5 (SUSE Linux Enterprise Software Development Kit), 10 (Debian GNU/Linux), - (openSUSE Tumbleweed), 20.04 LTS (Ubuntu), 4.0 (SUSE CaaS Platform), 15 SP1-LTSS (Suse Linux Enterprise Server), 15 SP1-LTSS (SUSE Linux Enterprise High Performance Computing), 11 (Debian GNU/Linux), 12 (Debian GNU/Linux), 8.1 Update Services for SAP Solutions (Red Hat Enterprise Linux), 7.3 (\u0420\u0415\u0414 \u041e\u0421), 1.7 (Astra Linux Special Edition), 15.4 (OpenSUSE Leap), 15 SP3 (SUSE Linux Enterprise Server for SAP Applications), 15 SP2 (SUSE Linux Enterprise Server for SAP Applications), 15 SP2-LTSS (SUSE Linux Enterprise High Performance Computing), 15 SP4 (SUSE Linux Enterprise Server for SAP Applications), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 15 SP2-LTSS (Suse Linux Enterprise Server), 15 SP4 (SUSE Linux Enterprise High Performance Computing), 7.1 (SUSE Enterprise Storage), 15 SP4 (SUSE Linux Enterprise Module for Desktop Applications), 15 SP4 (SUSE Linux Enterprise Workstation Extension), 4.7 (Astra Linux Special Edition), 8.2 Telecommunications Update Service (Red Hat Enterprise Linux), 8.2 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.6 Extended Update Support (Red Hat Enterprise Linux), 9.0 Extended Update Support (Red Hat Enterprise Linux), 8.2 Advanced Update Support (Red Hat Enterprise Linux), 15 SP3-LTSS (Suse Linux Enterprise Server), 15 SP3-ESPOS (SUSE Linux Enterprise High Performance Computing), 15 SP3-LTSS (SUSE Linux Enterprise High Performance Computing), 15 SP4 (SUSE Linux Enterprise Module for Package Hub), 15 SP5 (SUSE Linux Enterprise Server for SAP Applications), 15 SP5 (SUSE Linux Enterprise High Performance Computing), 23.04 (Ubuntu), 15 SP5 (SUSE Linux Enterprise Module for Desktop Applications), 12.4 (\u0420\u041e\u0421\u0410 \u0425\u0420\u041e\u041c), 8.4 Telecommunications Update Service (Red Hat Enterprise Linux), 8.4 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.4 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), 15 SP5 (SUSE Linux Enterprise Module for Package Hub), \u0434\u043e 118 (Firefox), \u0434\u043e 115.3 (Firefox ESR), \u0434\u043e 115.3 (Thunderbird), - (\u0410\u041b\u042c\u0422 \u0421\u041f 10), 15 SP5 (SUSE Linux Enterprise Workstation Extension), \u0434\u043e 2.9 (\u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Mozilla Corp.:\nhttps://www.mozilla.org/security/advisories/mfsa2023-41/\n\nhttps://www.mozilla.org/security/advisories/mfsa2023-43/\n\nhttps://www.mozilla.org/security/advisories/mfsa2023-42\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2023-5176\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/CVE-2023-5176\n\n\u0414\u043b\u044f Ubuntu:\nhttps://ubuntu.com/security/notices/USN-6405-1\nhttps://ubuntu.com/security/notices/USN-6404-1\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Novell Inc.:\nhttps://www.suse.com/security/cve/CVE-2023-5176.html\n\n\u0414\u043b\u044f \u041e\u0421 Astra Linux Special Edition 1.7:\n- \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 firefox \u0434\u043e 118.0.1+build1-0ubuntu0.20.04.1~mt1+ci202309291803+astra13 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17\n- \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 thunderbird \u0434\u043e 1:115.3.1+build1-0ubuntu1+ci202310041156+astra2 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17\n\n\u0414\u043b\u044f Astra Linux 1.6 \u00ab\u0421\u043c\u043e\u043b\u0435\u043d\u0441\u043a\u00bb:\n- \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 thunderbird \u0434\u043e 1:115.5.0+build1-0ubuntu1+ci202311280951+astra2 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16\n- \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 firefox \u0434\u043e 120.0+build2-0ubuntu0.20.04.1+ci202311281348+astra13 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16\n\n\u0414\u043b\u044f \u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f thunderbird \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1:115.5.0+repack-1~deb10u1.osnova1\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f firefox-esr \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 115.5.0esr+repack-1~deb10u1.osnova1\n\n\u0414\u043b\u044f \u041e\u0421 \u0410\u043b\u044c\u0442 8 \u0421\u041f (\u0440\u0435\u043b\u0438\u0437 10): \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0437 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430\n\n\u0414\u043b\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0420\u041e\u0421\u0410 \u0425\u0420\u041e\u041c:https://abf.rosalinux.ru/advisories/ROSA-SA-2024-2371\n\n\u0414\u043b\u044f Astra Linux Special Edition 4.7:\n- \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 firefox \u0434\u043e 118.0.1+build1-0ubuntu0.20.04.1~mt1+ci202309291803+astra13 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47\n- \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 thunderbird \u0434\u043e 1:115.3.1+build1-0ubuntu1+ci202310041156+astra2 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47\n\n\u0414\u043b\u044f \u0420\u0435\u0434\u041e\u0421: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "27.09.2023",
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "25.09.2024",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "28.10.2023",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2023-07235",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2023-5176",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Red Hat Enterprise Linux, Astra Linux Special Edition (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), OpenSUSE Leap, SUSE Linux Enterprise Server for SAP Applications, SUSE Linux Enterprise Software Development Kit, Debian GNU/Linux, openSUSE Tumbleweed, Ubuntu, SUSE CaaS Platform, Suse Linux Enterprise Server, SUSE Linux Enterprise High Performance Computing, \u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), SUSE Enterprise Storage, SUSE Linux Enterprise Module for Desktop Applications, SUSE Linux Enterprise Workstation Extension, SUSE Linux Enterprise Module for Package Hub, \u0420\u041e\u0421\u0410 \u0425\u0420\u041e\u041c (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21161607), Firefox, Firefox ESR, Thunderbird, \u0410\u041b\u042c\u0422 \u0421\u041f 10, \u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21165913)",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Red Hat Inc. Red Hat Enterprise Linux 6 , Red Hat Inc. Red Hat Enterprise Linux 7 , \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition 1.6 \u00ab\u0421\u043c\u043e\u043b\u0435\u043d\u0441\u043a\u00bb (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), Novell Inc. OpenSUSE Leap 15.5 , Red Hat Inc. Red Hat Enterprise Linux 8 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP1 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP5 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 10 , Novell Inc. openSUSE Tumbleweed - , Canonical Ltd. Ubuntu 20.04 LTS , Novell Inc. Suse Linux Enterprise Server 15 SP1-LTSS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 12 , Red Hat Inc. Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 7.3 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition 1.7 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), Novell Inc. OpenSUSE Leap 15.4 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP3 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP2 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP4 , Canonical Ltd. Ubuntu 22.04 LTS , Red Hat Inc. Red Hat Enterprise Linux 9 , Novell Inc. Suse Linux Enterprise Server 15 SP2-LTSS , \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb Astra Linux Special Edition 4.7 ARM (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), Red Hat Inc. Red Hat Enterprise Linux 8.2 Telecommunications Update Service , Red Hat Inc. Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions , Red Hat Inc. Red Hat Enterprise Linux 8.6 Extended Update Support , Red Hat Inc. Red Hat Enterprise Linux 9.0 Extended Update Support , Red Hat Inc. Red Hat Enterprise Linux 8.2 Advanced Update Support , Novell Inc. Suse Linux Enterprise Server 15 SP3-LTSS , Novell Inc. SUSE Linux Enterprise Module for Package Hub 15 SP4 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP5 , Canonical Ltd. Ubuntu 23.04 , \u0410\u041e \u00ab\u041d\u0422\u0426 \u0418\u0422 \u0420\u041e\u0421\u0410\u00bb \u0420\u041e\u0421\u0410 \u0425\u0420\u041e\u041c 12.4 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21161607), Red Hat Inc. Red Hat Enterprise Linux 8.4 Telecommunications Update Service , Red Hat Inc. Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions , Red Hat Inc. Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support , Novell Inc. SUSE Linux Enterprise Module for Package Hub 15 SP5 , \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb \u0410\u041b\u042c\u0422 \u0421\u041f 10 - , \u0410\u041e \"\u041d\u041f\u041f\u041a\u0422\" \u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx \u0434\u043e 2.9 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21165913)",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0430 Thunderbird \u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 Firefox, Firefox ESR, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0430\u043c\u0438 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0417\u0430\u043f\u0438\u0441\u044c \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0430\u043c\u0438 \u0431\u0443\u0444\u0435\u0440\u0430 (CWE-787)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0430 Thunderbird \u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 Firefox, Firefox ESR \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0430\u043c\u0438 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.rapid7.com/db/vulnerabilities/ubuntu-cve-2023-5176/\nhttps://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195\nhttps://www.debian.org/security/2023/dsa-5513\nhttps://www.mozilla.org/security/advisories/mfsa2023-42/\nhttps://lists.debian.org/debian-lts-announce/2023/09/msg00034.html\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-5176\nhttps://www.rapid7.com/db/vulnerabilities/redhat_linux-cve-2023-5176/\nhttps://www.debian.org/security/2023/dsa-5506\nhttps://www.mozilla.org/security/advisories/mfsa2023-43/\nhttps://lists.debian.org/debian-lts-announce/2023/10/msg00015.html\nhttps://www.rapid7.com/db/vulnerabilities/oracle_linux-cve-2023-5176/\nhttps://www.mozilla.org/security/advisories/mfsa2023-41/\nhttps://security-tracker.debian.org/tracker/CVE-2023-5176\nhttps://access.redhat.com/security/cve/CVE-2023-5176\nhttps://ubuntu.com/security/notices/USN-6405-1\nhttps://ubuntu.com/security/notices/USN-6404-1\nhttps://www.suse.com/security/cve/CVE-2023-5176.html\nhttps://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17\nhttps://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16\nhttps://\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430.\u043d\u043f\u043f\u043a\u0442.\u0440\u0444/bin/view/\u041e\u0421\u043d\u043e\u0432\u0430/\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f/2.9/\nhttps://abf.rosalinux.ru/advisories/ROSA-SA-2024-2371\nhttps://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47\nhttp://repo.red-soft.ru/redos/7.3c/x86_64/updates/",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-787",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,8)"
}
CERTFR-2023-AVI-0783
Vulnerability from certfr_avis - Published: 2023-09-27 - Updated: 2023-09-27
De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
None| Vendor | Product | Description | ||
|---|---|---|---|---|
| Mozilla | Firefox | Firefox versions antérieures à 118 | ||
| Mozilla | Firefox ESR | Firefox ESR versions antérieures à 115.3 | ||
| Mozilla | Thunderbird | Thunderbird versions antérieures à 115.3 |
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Firefox versions ant\u00e9rieures \u00e0 118",
"product": {
"name": "Firefox",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Firefox ESR versions ant\u00e9rieures \u00e0 115.3",
"product": {
"name": "Firefox ESR",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Thunderbird versions ant\u00e9rieures \u00e0 115.3",
"product": {
"name": "Thunderbird",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-5173",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5173"
},
{
"name": "CVE-2023-5176",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5176"
},
{
"name": "CVE-2023-5175",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5175"
},
{
"name": "CVE-2023-5171",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5171"
},
{
"name": "CVE-2023-5174",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5174"
},
{
"name": "CVE-2023-5170",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5170"
},
{
"name": "CVE-2023-5172",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5172"
},
{
"name": "CVE-2023-5168",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5168"
},
{
"name": "CVE-2023-5169",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5169"
}
],
"initial_release_date": "2023-09-27T00:00:00",
"last_revision_date": "2023-09-27T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-0783",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-09-27T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nMozilla. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Mozilla",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2023-42 du 28 ao\u00fbt 2023",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2023-42/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2023-43 du 28 ao\u00fbt 2023",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2023-43/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2023-41 du 28 ao\u00fbt 2023",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2023-41/"
}
]
}
厂商已发布了漏洞修复程序,请及时关注更新: https://www.mozilla.org/en-US/security/advisories/mfsa2023-41/#CVE-2023-5176
| Name | ['Mozilla Firefox <118', 'Mozilla Firefox ESR <115.3', 'Mozilla Thunderbird <115.3'] |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2023-5176",
"cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-5176"
}
},
"description": "Mozilla Firefox\u662f\u7f8e\u56fdMozilla\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u5f00\u6e90Web\u6d4f\u89c8\u5668\u3002 \n\nMozilla Firefox\u5b58\u5728\u5185\u5b58\u7834\u574f\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u63d0\u4ea4\u7279\u6b8a\u7684Web\u8bf7\u6c42\uff0c\u8bf1\u4f7f\u7528\u6237\u89e3\u6790\uff0c\u53ef\u4f7f\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\u6216\u4ee5\u5e94\u7528\u7a0b\u5e8f\u4e0a\u4e0b\u6587\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
"formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2023-41/#CVE-2023-5176",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2023-74540",
"openTime": "2023-10-07",
"patchDescription": "Mozilla Firefox\u662f\u7f8e\u56fdMozilla\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u5f00\u6e90Web\u6d4f\u89c8\u5668\u3002 \r\n\r\nMozilla Firefox\u5b58\u5728\u5185\u5b58\u7834\u574f\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u63d0\u4ea4\u7279\u6b8a\u7684Web\u8bf7\u6c42\uff0c\u8bf1\u4f7f\u7528\u6237\u89e3\u6790\uff0c\u53ef\u4f7f\u5e94\u7528\u7a0b\u5e8f\u5d29\u6e83\u6216\u4ee5\u5e94\u7528\u7a0b\u5e8f\u4e0a\u4e0b\u6587\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Mozilla Firefox\u5185\u5b58\u7834\u574f\u6f0f\u6d1e\uff08CNVD-2023-74540\uff09\u7684\u8865\u4e01",
"products": {
"product": [
"Mozilla Firefox \u003c118",
"Mozilla Firefox ESR \u003c115.3",
"Mozilla Thunderbird \u003c115.3"
]
},
"referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-5176",
"serverity": "\u9ad8",
"submitTime": "2023-10-07",
"title": "Mozilla Firefox\u5185\u5b58\u7834\u574f\u6f0f\u6d1e\uff08CNVD-2023-74540\uff09"
}
FKIE_CVE-2023-5176
Vulnerability from fkie_nvd - Published: 2023-09-27 15:19 - Updated: 2025-05-01 18:159.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| URL | Tags | ||
|---|---|---|---|
| security@mozilla.org | https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195 | Broken Link, Issue Tracking, Permissions Required | |
| security@mozilla.org | https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html | Mailing List, Third Party Advisory | |
| security@mozilla.org | https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html | Mailing List, Third Party Advisory | |
| security@mozilla.org | https://www.debian.org/security/2023/dsa-5506 | Third Party Advisory | |
| security@mozilla.org | https://www.debian.org/security/2023/dsa-5513 | Third Party Advisory | |
| security@mozilla.org | https://www.mozilla.org/security/advisories/mfsa2023-41/ | Vendor Advisory | |
| security@mozilla.org | https://www.mozilla.org/security/advisories/mfsa2023-42/ | Vendor Advisory | |
| security@mozilla.org | https://www.mozilla.org/security/advisories/mfsa2023-43/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195 | Broken Link, Issue Tracking, Permissions Required | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.debian.org/security/2023/dsa-5506 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.debian.org/security/2023/dsa-5513 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.mozilla.org/security/advisories/mfsa2023-41/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.mozilla.org/security/advisories/mfsa2023-42/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.mozilla.org/security/advisories/mfsa2023-43/ | Vendor Advisory |
| Vendor | Product | Version | |
|---|---|---|---|
| mozilla | firefox | * | |
| mozilla | firefox_esr | * | |
| mozilla | thunderbird | * | |
| debian | debian_linux | 10.0 | |
| debian | debian_linux | 11.0 | |
| debian | debian_linux | 12.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2216A424-94E2-45E7-BB95-646BFC8182E1",
"versionEndExcluding": "118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EED826DF-6AB2-4D04-A4FC-A90EFDCB5EB9",
"versionEndExcluding": "115.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3ED03DF1-442F-4750-84BF-8C37C606843A",
"versionEndExcluding": "115.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
"matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3."
},
{
"lang": "es",
"value": "Errores de seguridad de la memoria presentes en Firefox 117, Firefox ESR 115.2 y Thunderbird 115.2. Algunos de estos errores mostraron evidencia de corrupci\u00f3n de memoria y suponemos que con suficiente esfuerzo algunos de ellos podr\u00edan haberse aprovechado para ejecutar c\u00f3digo arbitrario. Esta vulnerabilidad afecta a Firefox \u0026lt; 118, Firefox ESR \u0026lt; 115.3 y Thunderbird \u0026lt; 115.3."
}
],
"id": "CVE-2023-5176",
"lastModified": "2025-05-01T18:15:52.350",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2023-09-27T15:19:42.767",
"references": [
{
"source": "security@mozilla.org",
"tags": [
"Broken Link",
"Issue Tracking",
"Permissions Required"
],
"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195"
},
{
"source": "security@mozilla.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html"
},
{
"source": "security@mozilla.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html"
},
{
"source": "security@mozilla.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5506"
},
{
"source": "security@mozilla.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5513"
},
{
"source": "security@mozilla.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2023-41/"
},
{
"source": "security@mozilla.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2023-42/"
},
{
"source": "security@mozilla.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2023-43/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Issue Tracking",
"Permissions Required"
],
"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5506"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5513"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2023-41/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2023-42/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2023-43/"
}
],
"sourceIdentifier": "security@mozilla.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
GHSA-238M-XCCF-M2F6
Vulnerability from github – Published: 2023-09-27 15:30 – Updated: 2024-04-04 07:55Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3.
{
"affected": [],
"aliases": [
"CVE-2023-5176"
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-27T15:19:42Z",
"severity": "CRITICAL"
},
"details": "Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3.",
"id": "GHSA-238m-xccf-m2f6",
"modified": "2024-04-04T07:55:58Z",
"published": "2023-09-27T15:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5176"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5506"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5513"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2023-41"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2023-42"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2023-43"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GSD-2023-5176
Vulnerability from gsd - Updated: 2023-12-13 01:20{
"GSD": {
"alias": "CVE-2023-5176",
"id": "GSD-2023-5176"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2023-5176"
],
"details": "Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3.",
"id": "GSD-2023-5176",
"modified": "2023-12-13T01:20:50.605647Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security@mozilla.org",
"ID": "CVE-2023-5176",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Firefox",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "unspecified",
"version_value": "118"
}
]
}
},
{
"product_name": "Firefox ESR",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "unspecified",
"version_value": "115.3"
}
]
}
},
{
"product_name": "Thunderbird",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "unspecified",
"version_value": "115.3"
}
]
}
}
]
},
"vendor_name": "Mozilla"
}
]
}
},
"credits": [
{
"lang": "en",
"value": "Chris Peterson, Andrew McCreight, Andr\u00e9 Bargull, Nika Layzell and the Mozilla Fuzzing Team"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195",
"refsource": "MISC",
"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195"
},
{
"name": "https://www.mozilla.org/security/advisories/mfsa2023-41/",
"refsource": "MISC",
"url": "https://www.mozilla.org/security/advisories/mfsa2023-41/"
},
{
"name": "https://www.mozilla.org/security/advisories/mfsa2023-42/",
"refsource": "MISC",
"url": "https://www.mozilla.org/security/advisories/mfsa2023-42/"
},
{
"name": "https://www.mozilla.org/security/advisories/mfsa2023-43/",
"refsource": "MISC",
"url": "https://www.mozilla.org/security/advisories/mfsa2023-43/"
},
{
"name": "https://www.debian.org/security/2023/dsa-5506",
"refsource": "MISC",
"url": "https://www.debian.org/security/2023/dsa-5506"
},
{
"name": "https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html",
"refsource": "MISC",
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html"
},
{
"name": "https://www.debian.org/security/2023/dsa-5513",
"refsource": "MISC",
"url": "https://www.debian.org/security/2023/dsa-5513"
},
{
"name": "https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html",
"refsource": "MISC",
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "118",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "115.3",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "115.3",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security@mozilla.org",
"ID": "CVE-2023-5176"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.mozilla.org/security/advisories/mfsa2023-41/",
"refsource": "MISC",
"tags": [
"Vendor Advisory"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2023-41/"
},
{
"name": "https://www.mozilla.org/security/advisories/mfsa2023-43/",
"refsource": "MISC",
"tags": [
"Vendor Advisory"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2023-43/"
},
{
"name": "https://www.mozilla.org/security/advisories/mfsa2023-42/",
"refsource": "MISC",
"tags": [
"Vendor Advisory"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2023-42/"
},
{
"name": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195",
"refsource": "MISC",
"tags": [
"Broken Link",
"Issue Tracking",
"Permissions Required"
],
"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195"
},
{
"name": "https://www.debian.org/security/2023/dsa-5506",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5506"
},
{
"name": "https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html",
"refsource": "MISC",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html"
},
{
"name": "https://www.debian.org/security/2023/dsa-5513",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2023/dsa-5513"
},
{
"name": "https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html",
"refsource": "MISC",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html"
}
]
}
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
},
"lastModifiedDate": "2023-10-12T02:56Z",
"publishedDate": "2023-09-27T15:19Z"
}
}
}
MSRC_CVE-2023-5176
Vulnerability from csaf_microsoft - Published: 2023-09-01 00:00 - Updated: 2025-09-04 00:11| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 17084-1 | — |
| URL | Category |
|---|---|
| https://msrc.microsoft.com/csaf/vex/2023/msrc_cve… | self |
| https://support.microsoft.com/lifecycle | external |
| https://www.first.org/cvss | external |
| https://msrc.microsoft.com/csaf/vex/2023/msrc_cve… | self |
{
"document": {
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
"title": "Disclaimer"
}
],
"publisher": {
"category": "vendor",
"contact_details": "secure@microsoft.com",
"name": "Microsoft Security Response Center",
"namespace": "https://msrc.microsoft.com"
},
"references": [
{
"category": "self",
"summary": "CVE-2023-5176 Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3. - VEX",
"url": "https://msrc.microsoft.com/csaf/vex/2023/msrc_cve-2023-5176.json"
},
{
"category": "external",
"summary": "Microsoft Support Lifecycle",
"url": "https://support.microsoft.com/lifecycle"
},
{
"category": "external",
"summary": "Common Vulnerability Scoring System",
"url": "https://www.first.org/cvss"
}
],
"title": "Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3.",
"tracking": {
"current_release_date": "2025-09-04T00:11:43.000Z",
"generator": {
"date": "2025-12-27T17:14:15.650Z",
"engine": {
"name": "MSRC Generator",
"version": "1.0"
}
},
"id": "msrc_CVE-2023-5176",
"initial_release_date": "2023-09-01T00:00:00.000Z",
"revision_history": [
{
"date": "2025-09-04T00:11:43.000Z",
"legacy_version": "1",
"number": "1",
"summary": "Information published."
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "3.0",
"product": {
"name": "Azure Linux 3.0",
"product_id": "17084"
}
}
],
"category": "product_name",
"name": "Azure Linux"
},
{
"category": "product_name",
"name": "azl3 mozjs 102.15.1-1",
"product": {
"name": "azl3 mozjs 102.15.1-1",
"product_id": "1"
}
}
],
"category": "vendor",
"name": "Microsoft"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "azl3 mozjs 102.15.1-1 as a component of Azure Linux 3.0",
"product_id": "17084-1"
},
"product_reference": "1",
"relates_to_product_reference": "17084"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-5176",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"flags": [
{
"label": "component_not_present",
"product_ids": [
"17084-1"
]
}
],
"notes": [
{
"category": "general",
"text": "mozilla",
"title": "Assigning CNA"
}
],
"product_status": {
"known_not_affected": [
"17084-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-5176 Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3. - VEX",
"url": "https://msrc.microsoft.com/csaf/vex/2023/msrc_cve-2023-5176.json"
}
],
"title": "Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3."
}
]
}
OPENSUSE-SU-2024:13268-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64 | — |
Vendor Fix
|
| URL | Category |
|---|---|
| https://www.suse.com/support/security/rating/ | external |
| https://ftp.suse.com/pub/projects/security/csaf/o… | self |
| https://www.suse.com/security/cve/CVE-2023-5168/ | self |
| https://www.suse.com/security/cve/CVE-2023-5169/ | self |
| https://www.suse.com/security/cve/CVE-2023-5171/ | self |
| https://www.suse.com/security/cve/CVE-2023-5174/ | self |
| https://www.suse.com/security/cve/CVE-2023-5176/ | self |
| https://www.suse.com/security/cve/CVE-2023-5168 | external |
| https://bugzilla.suse.com/1215575 | external |
| https://www.suse.com/security/cve/CVE-2023-5169 | external |
| https://bugzilla.suse.com/1215575 | external |
| https://www.suse.com/security/cve/CVE-2023-5171 | external |
| https://bugzilla.suse.com/1215575 | external |
| https://www.suse.com/security/cve/CVE-2023-5174 | external |
| https://bugzilla.suse.com/1215575 | external |
| https://www.suse.com/security/cve/CVE-2023-5176 | external |
| https://bugzilla.suse.com/1215575 | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "MozillaThunderbird-115.3.0-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the MozillaThunderbird-115.3.0-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-13268",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13268-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-5168 page",
"url": "https://www.suse.com/security/cve/CVE-2023-5168/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-5169 page",
"url": "https://www.suse.com/security/cve/CVE-2023-5169/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-5171 page",
"url": "https://www.suse.com/security/cve/CVE-2023-5171/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-5174 page",
"url": "https://www.suse.com/security/cve/CVE-2023-5174/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-5176 page",
"url": "https://www.suse.com/security/cve/CVE-2023-5176/"
}
],
"title": "MozillaThunderbird-115.3.0-1.1 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:13268-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "MozillaThunderbird-115.3.0-1.1.aarch64",
"product": {
"name": "MozillaThunderbird-115.3.0-1.1.aarch64",
"product_id": "MozillaThunderbird-115.3.0-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"product": {
"name": "MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"product_id": "MozillaThunderbird-translations-common-115.3.0-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"product": {
"name": "MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"product_id": "MozillaThunderbird-translations-other-115.3.0-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "MozillaThunderbird-115.3.0-1.1.ppc64le",
"product": {
"name": "MozillaThunderbird-115.3.0-1.1.ppc64le",
"product_id": "MozillaThunderbird-115.3.0-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"product": {
"name": "MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"product_id": "MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"product": {
"name": "MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"product_id": "MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "MozillaThunderbird-115.3.0-1.1.s390x",
"product": {
"name": "MozillaThunderbird-115.3.0-1.1.s390x",
"product_id": "MozillaThunderbird-115.3.0-1.1.s390x"
}
},
{
"category": "product_version",
"name": "MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"product": {
"name": "MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"product_id": "MozillaThunderbird-translations-common-115.3.0-1.1.s390x"
}
},
{
"category": "product_version",
"name": "MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"product": {
"name": "MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"product_id": "MozillaThunderbird-translations-other-115.3.0-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "MozillaThunderbird-115.3.0-1.1.x86_64",
"product": {
"name": "MozillaThunderbird-115.3.0-1.1.x86_64",
"product_id": "MozillaThunderbird-115.3.0-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"product": {
"name": "MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"product_id": "MozillaThunderbird-translations-common-115.3.0-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "MozillaThunderbird-translations-other-115.3.0-1.1.x86_64",
"product": {
"name": "MozillaThunderbird-translations-other-115.3.0-1.1.x86_64",
"product_id": "MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaThunderbird-115.3.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64"
},
"product_reference": "MozillaThunderbird-115.3.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaThunderbird-115.3.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le"
},
"product_reference": "MozillaThunderbird-115.3.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaThunderbird-115.3.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x"
},
"product_reference": "MozillaThunderbird-115.3.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaThunderbird-115.3.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64"
},
"product_reference": "MozillaThunderbird-115.3.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaThunderbird-translations-common-115.3.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64"
},
"product_reference": "MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le"
},
"product_reference": "MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaThunderbird-translations-common-115.3.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x"
},
"product_reference": "MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaThunderbird-translations-common-115.3.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64"
},
"product_reference": "MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaThunderbird-translations-other-115.3.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64"
},
"product_reference": "MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le"
},
"product_reference": "MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaThunderbird-translations-other-115.3.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x"
},
"product_reference": "MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "MozillaThunderbird-translations-other-115.3.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
},
"product_reference": "MozillaThunderbird-translations-other-115.3.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-5168",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-5168"
}
],
"notes": [
{
"category": "general",
"text": "A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.\n*This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-5168",
"url": "https://www.suse.com/security/cve/CVE-2023-5168"
},
{
"category": "external",
"summary": "SUSE Bug 1215575 for CVE-2023-5168",
"url": "https://bugzilla.suse.com/1215575"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2023-5168"
},
{
"cve": "CVE-2023-5169",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-5169"
}
],
"notes": [
{
"category": "general",
"text": "A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-5169",
"url": "https://www.suse.com/security/cve/CVE-2023-5169"
},
{
"category": "external",
"summary": "SUSE Bug 1215575 for CVE-2023-5169",
"url": "https://bugzilla.suse.com/1215575"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2023-5169"
},
{
"cve": "CVE-2023-5171",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-5171"
}
],
"notes": [
{
"category": "general",
"text": "During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-5171",
"url": "https://www.suse.com/security/cve/CVE-2023-5171"
},
{
"category": "external",
"summary": "SUSE Bug 1215575 for CVE-2023-5171",
"url": "https://bugzilla.suse.com/1215575"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2023-5171"
},
{
"cve": "CVE-2023-5174",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-5174"
}
],
"notes": [
{
"category": "general",
"text": "If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash.\n*This bug only affects Firefox on Windows when run in non-standard configurations (such as using `runas`). Other operating systems are unaffected.* This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-5174",
"url": "https://www.suse.com/security/cve/CVE-2023-5174"
},
{
"category": "external",
"summary": "SUSE Bug 1215575 for CVE-2023-5174",
"url": "https://bugzilla.suse.com/1215575"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2023-5174"
},
{
"cve": "CVE-2023-5176",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-5176"
}
],
"notes": [
{
"category": "general",
"text": "Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 118, Firefox ESR \u003c 115.3, and Thunderbird \u003c 115.3.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-5176",
"url": "https://www.suse.com/security/cve/CVE-2023-5176"
},
{
"category": "external",
"summary": "SUSE Bug 1215575 for CVE-2023-5176",
"url": "https://bugzilla.suse.com/1215575"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-common-115.3.0-1.1.x86_64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.aarch64",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.ppc64le",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.s390x",
"openSUSE Tumbleweed:MozillaThunderbird-translations-other-115.3.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2023-5176"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.