Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2023-4575: Firefox/Thunderbird can crash opening file picker
CVE-2023-4575 · published 3 years ago
Summary
When the file chooser dialog is opened, the program could create duplicate callbacks that are all destroyed at once, leading to a memory error and a possible crash. This affects Firefox versions before 117 and certain older Thunderbird releases. Updating to the latest Firefox and Thunderbird releases eliminates the risk.
What to do
- Update debian firefox-esr to version 102.15.0esr-1~deb12u1.
- Update debian firefox-esr to version 115.2.0esr-1.
- Update debian thunderbird to version 1:102.15.0-1~deb12u1.
- Update debian thunderbird to version 1:115.2.0-1.
- Update mozilla firefox_esr to version 102.15 or later.
- Update mozilla thunderbird to version 115.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | firefox-esr |
< 102.15.0esr-1~deb12u1 Fix: upgrade to 102.15.0esr-1~deb12u1
|
| Debian:13 | debian | firefox-esr |
< 115.2.0esr-1 Fix: upgrade to 115.2.0esr-1
|
| Debian:14 | debian | firefox-esr |
< 115.2.0esr-1 Fix: upgrade to 115.2.0esr-1
|
| Debian:12 | debian | thunderbird |
< 1:102.15.0-1~deb12u1 Fix: upgrade to 1:102.15.0-1~deb12u1
|
| Debian:13 | debian | thunderbird |
< 1:115.2.0-1 Fix: upgrade to 1:115.2.0-1
|
| Debian:14 | debian | thunderbird |
< 1:115.2.0-1 Fix: upgrade to 1:115.2.0-1
|
| – | mozilla | firefox |
< 117.0 >= 115.0, < 115.2 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| – | mozilla | firefox_esr |
< 102.15 cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* |
| – | mozilla | thunderbird |
< 115.2 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
Original advisory text
When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of ...
When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.
References
- https://security-tracker.debian.org/tracker/CVE-2023-4575 Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1846689 Issue Tracking
- https://www.mozilla.org/security/advisories/mfsa2023-34/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-35/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-36/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-37/
- https://www.mozilla.org/security/advisories/mfsa2023-38/ Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.5
Medium
Type
CWE-416Use After Free
Timeline
Published11 Sep 2023
Updated4 Nov 2026
First seen15 Sep 2026
Track software like this
Free during beta