CVE-2023-37202 — Use After Free in Mozilla Firefox
Severity
8.8HIGHNVD
OSV6.5OSV3.1
EPSS
0.7%
top 28.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 5
Latest updateJul 13
Description
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages9 packages
Also affects: Debian Linux 10.0, 11.0, 12.0
🔴Vulnerability Details
5OSV▶
CVE-2023-37202: Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting↗2023-07-05
CVEList▶
CVE-2023-37202: Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting↗2023-07-05
GHSA▶
GHSA-hhm4-xgvr-x3rg: Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting↗2023-07-05
📋Vendor Advisories
8Debian▶
CVE-2023-37202: firefox - Cross-compartment wrappers wrapping a scripted proxy could have caused objects f...↗2023