Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2023-4057: Firefox ESR and Thunderbird could allow code execution
CVE-2023-4057 · published 3 years ago
Summary
Versions of Firefox ESR and Thunderbird before the latest updates contain flaws that could let a malicious website or email cause the program to run unwanted code on a computer. This could give an attacker control over the affected system. Updating to the newest version of each application fixes the problem.
What to do
- Update debian firefox-esr to version 115.1.0esr-1.
- Update debian thunderbird to version 1:115.1.0-1.
- Update mozilla firefox to version 116.0 or later.
- Update mozilla firefox_esr to version 115.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | firefox-esr |
< 115.1.0esr-1 Fix: upgrade to 115.1.0esr-1
|
| Debian:14 | debian | firefox-esr |
< 115.1.0esr-1 Fix: upgrade to 115.1.0esr-1
|
| Debian:13 | debian | thunderbird |
< 1:115.1.0-1 Fix: upgrade to 1:115.1.0-1
|
| Debian:14 | debian | thunderbird |
< 1:115.1.0-1 Fix: upgrade to 1:115.1.0-1
|
| – | mozilla | firefox |
< 116.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| – | mozilla | firefox_esr |
< 115.1 cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* |
Original advisory text
Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these cou...
Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1.
References
- https://security-tracker.debian.org/tracker/CVE-2023-4057 Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1841682 Issue Tracking Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2023-29/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-31/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-33/
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-787Out-of-bounds Write
Timeline
Published1 Aug 2023
Updated3 Nov 2026
First seen15 Sep 2026
Track software like this
Free during beta