CVE-2023-25751 — Code Injection in Mozilla Firefox

CWE-94 — Code Injection16 documents8 sources
Severity
6.5MEDIUMNVD
OSV8.8OSV4.3
EPSS
0.1%
top 69.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxMozilla Firefox ESRMozilla Thunderbird
Timeline
PublishedJun 2

Description

Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages9 packages

▶CVEListV5mozilla/firefoxunspecified — 111
▶NVDmozilla/firefox< 111.0
▶CVEListV5mozilla/firefox_esrunspecified — 102.9
▶NVDmozilla/firefox_esr< 102.9
▶Ubuntumozilla/firefox< 111.0+build2-0ubuntu0.18.04.1+3

🔴Vulnerability Details

6
GHSA
GHSA-vqx7-j992-3mg7: Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly↗2023-06-02
▶
CVEList
CVE-2023-25751: Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly↗2023-06-02
▶
OSV
CVE-2023-25751: Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly↗2023-06-02
▶
OSV
thunderbird vulnerabilities↗2023-03-27
▶
OSV
firefox regressions↗2023-03-27
▶

📋Vendor Advisories

9
Ubuntu
SpiderMonkey vulnerabilities↗2023-05-30
▶
Ubuntu
Thunderbird vulnerabilities↗2023-03-27
▶
Ubuntu
Firefox regressions↗2023-03-27
▶
Ubuntu
Firefox vulnerabilities↗2023-03-15
▶
Red Hat
Mozilla: Incorrect code generation during JIT compilation↗2023-03-14
▶
CVE-2023-25751 — Code Injection in Mozilla Firefox | cvebase