CVE-2023-4581 — Compilation with Insufficient Warnings or Errors in Mozilla Firefox

CWE-1127 — Compilation with Insufficient Warnings or Errors15 documents8 sources

Severity

4.3MEDIUMNVD

OSV6.5

EPSS

0.2%

top 61.87%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mozilla Firefox Mozilla Firefox ESR Mozilla Thunderbird

Timeline

PublishedSep 11

Latest updateSep 14

Description

Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages9 packages

▶CVEListV5mozilla/firefoxunspecified — 117

▶NVDmozilla/firefox115.0 — 115.2+1

▶CVEListV5mozilla/firefox_esrunspecified — 102.15+1

▶NVDmozilla/firefox_esr< 102.15

▶Ubuntumozilla/firefox< 117.0+build2-0ubuntu0.20.04.1

🔴Vulnerability Details

OSV

thunderbird vulnerabilities↗2023-09-14

▶

CVEList

XLL file extensions were downloadable without warnings↗2023-09-11

▶

GHSA

GHSA-r5px-qx88-c9gq: Excel `↗2023-09-11

▶

OSV

CVE-2023-4581: Excel `↗2023-09-11

▶

OSV

firefox vulnerabilities↗2023-08-30

▶

📋Vendor Advisories

Ubuntu

Thunderbird vulnerabilities↗2023-09-14

▶

Ubuntu

Firefox vulnerabilities↗2023-08-30

▶

Red Hat

Mozilla: XLL file extensions were downloadable without warnings↗2023-08-29

▶

Debian

CVE-2023-4581: firefox - Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable...↗2023

▶

Mozilla

Mozilla Foundation Security Advisory 2023-34: CVE-2023-4581↗

▶