CVE-2023-4048 — Out-of-bounds Read in Mozilla Firefox

CWE-125 — Out-of-bounds Read17 documents9 sources
Severity
7.5HIGHNVD
OSV5.3
EPSS
0.5%
top 35.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mozilla FirefoxMozilla Firefox ESRMozilla Thunderbird+1 more
Timeline
PublishedAug 1
Latest updateSep 4

Description

An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5mozilla/firefoxunspecified — 116
▶NVDmozilla/firefox102.0 — 102.14+2
▶CVEListV5mozilla/firefox_esrunspecified — 102.14+1
▶Ubuntumozilla/firefox< 116.0+build2-0ubuntu0.20.04.2
▶Debianmozilla/thunderbird< 1:102.14.0-1~deb11u1+3

Also affects: Debian Linux 10.0, 11.0, 12.0

🔴Vulnerability Details

6
OSV
firefox regressions↗2023-08-21
▶
OSV
firefox regressions↗2023-08-08
▶
OSV
firefox vulnerabilities↗2023-08-02
▶
GHSA
GHSA-969j-v3p3-p4vv: An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations↗2023-08-01
▶
OSV
CVE-2023-4048: An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations↗2023-08-01
▶

📋Vendor Advisories

10
Ubuntu
Thunderbird vulnerabilities↗2023-09-04
▶
Ubuntu
Firefox vulnerabilities↗2023-08-02
▶
Red Hat
Mozilla: Crash in DOMParser due to out-of-memory conditions↗2023-08-01
▶
Oracle
Oracle Oracle Analytics Risk Matrix: Machine Learning (OpenBLAS) — CVE-2021-4048↗2023-04-15
▶
Debian
CVE-2023-4048: firefox - An out-of-bounds read could have led to an exploitable crash when parsing HTML w...↗2023
▶
CVE-2023-4048 — Out-of-bounds Read in Mozilla Firefox | cvebase