Home

CVE-2021-23995

Description

When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

Risk Information

Base Score
8.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
1.035

Associated Vulnerability

VulnerabilityOS Platform
Multiple vulnerabilities fixed in Mozilla Firefox (88.0)Windows
Multiple vulnerabilities fixed in Mozilla Firefox (x64) (88.0)Windows
Multiple vulnerabilities fixed in Mozilla Firefox ESR (78.10.0)Windows
Multiple vulnerabilities fixed in Mozilla Firefox ESR (x64) (78.10.0)Windows
Multiple Vulnerabilities are affected in Mozilla Firefox (x64) 87.9-beta1Windows
Vulnerabilities CVE-2021-23994,CVE-2021-23995,CVE-2021-23998,CVE-2021-24002 are affected in Mozilla Firefox ESR (x64) 78.9Windows
Vulnerabilities CVE-2021-23994,CVE-2021-23995,CVE-2021-23998,CVE-2021-24002 are affected in Mozilla Firefox ESR 78.9Windows
Multiple Vulnerabilities are affected in Mozilla Thunderbird 78.9Windows
Multiple Vulnerabilities are affected in Mozilla_Firefox 87.9-beta1Windows
Multiple Vulnerabilities are affected in Mozilla Firefox ESR (x64) 78.9Windows
Multiple Vulnerabilities are affected in Mozilla Firefox ESR 78.9Windows
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac (88.0.1)Mac
Multiple vulnerabilities are fixed in Mozilla Thunderbird For Mac 78.10Mac
Multiple Vulnerabilities are affected in Firefox ESR for Mac 78.9Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 78.9Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 87.9-beta1Mac
Multiple Vulnerabilities are affected in Mozilla Thunderbird for Mac 78.9Mac
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac 78.10Mac
firefox-esr security update(DSA-4895-1) firefox-esr_78.10.0esr-1~deb10u1_i386.debLinux
firefox-esr security update(DSA-4895-1) firefox-esr_78.10.0esr-1~deb10u1_amd64.debLinux
thunderbird security update(DSA-4897-1) thunderbird_78.10.0-1~deb10u1_i386.debLinux
thunderbird security update(DSA-4897-1) thunderbird_78.10.0-1~deb10u1_amd64.debLinux
(RHSA-2021:1350) thunderbird security update thunderbird-78.10.0-1.el7_9.x86_64.rpmLinux
(RHSA-2021:1353) thunderbird security update thunderbird-78.10.0-1.el8_3.x86_64.rpmLinux
(RHSA-2021:1353) thunderbird security update thunderbird-debugsource-78.10.0-1.el8_3.x86_64.rpmLinux
(RHSA-2021:1360) firefox security update firefox-78.10.0-1.el8_3.x86_64.rpmLinux
(RHSA-2021:1360) firefox security update firefox-debugsource-78.10.0-1.el8_3.x86_64.rpmLinux
(RHSA-2021:1363) firefox security update firefox-78.10.0-1.el7_9.i686.rpmLinux
(RHSA-2021:1363) firefox security update firefox-78.10.0-1.el7_9.x86_64.rpmLinux
SUSE-SU-2021:1325-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-78.10.0-112.57.2.x86_64.rpmLinux
SUSE-SU-2021:1325-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-debuginfo-78.10.0-112.57.2.x86_64.rpmLinux
SUSE-SU-2021:1325-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-debugsource-78.10.0-112.57.2.x86_64.rpmLinux
SUSE-SU-2021:1325-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-devel-78.10.0-112.57.2.x86_64.rpmLinux
SUSE-SU-2021:1325-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-translations-common-78.10.0-112.57.2.x86_64.rpmLinux
Mozilla Open Source web browser (USN-4926-1) firefox_88.0+build2-0ubuntu0.16.04.1_i386.debLinux
Mozilla Open Source web browser (USN-4926-1) firefox_88.0+build2-0ubuntu0.16.04.1_amd64.debLinux
Mozilla Open Source web browser (USN-4926-1) firefox_88.0+build2-0ubuntu0.18.04.2_i386.debLinux
Mozilla Open Source web browser (USN-4926-1) firefox_88.0+build2-0ubuntu0.18.04.2_amd64.debLinux
Mozilla Open Source web browser (USN-4926-1) firefox_88.0+build2-0ubuntu0.20.04.1_amd64.debLinux
Mozilla Open Source web browser (USN-4926-1) firefox_88.0+build2-0ubuntu0.20.10.1_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4995-1) thunderbird_78.11.0+build1-0ubuntu0.20.04.2_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4995-1) thunderbird_78.11.0+build1-0ubuntu0.20.10.2_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4995-1) thunderbird_78.11.0+build1-0ubuntu0.21.04.2_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4995-2) thunderbird_78.11.0+build1-0ubuntu0.18.04.2_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4995-2) thunderbird_78.11.0+build1-0ubuntu0.18.04.2_amd64.debLinux

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-319192Mozilla Firefox (88.0)
PATCH-319193Mozilla Firefox (x64) (88.0)
PATCH-319194Mozilla Firefox ESR (78.10.0)
PATCH-319195Mozilla Firefox ESR (x64) (78.10.0)
PATCH-334458Mozilla Firefox (x64) (120.0)
PATCH-334457Mozilla Firefox (120.0)
PATCH-607000Mozilla Firefox For Mac (124.0)
PATCH-611807Mozilla Thunderbird For Mac (142.0)
PATCH-611808Mozilla Firefox ESR for MAC 128.14.0
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611807Mozilla Thunderbird For Mac (142.0)
PATCH-612783Mozilla Firefox For Mac (145.0.1)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234