Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.Download Mozilla Firefox 120 - A web browser independently provide the tabbed browsing combined with numerous handy features like pop-up blocker Mozilla Firefox:įirefox Quantum is a web browser independently provide the tabbed browsing combined with numerous handy features like pop-up blocker, Bookmarks, direct (integrated RSS), password manager, and more.Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. #CVE-2023-5176: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3 Reporter Chris Peterson, Andrew McCreight, André Bargull, Nika Layzell and the Mozilla Fuzzing Team Impact high Description This bug only affects Firefox on Windows when run in non-standard configurations (such as using runas). If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. #CVE-2023-5174: Double-free in process spawning on Windows Reporter Ronald Crane Impact moderate Description

#CVE-2023-5171: Use-after-free in Ion Compiler Reporter Lukas Bernhard Impact high Descriptionĭuring Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash. #CVE-2023-5169: Out-of-bounds write in PathOps Reporter sonakkbi Impact high DescriptionĪ compromised content process could have provided malicious data in a PathRecording resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process. This bug only affects Firefox on Windows. #CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1 Reporter sonakkbi Impact high DescriptionĪ compromised content process could have provided malicious data to FilterNodeD2D1 resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.

Mozilla Foundation Security Advisory 2023-42 Security Vulnerabilities fixed in Firefox ESR 115.3 Announced SeptemImpact high Products Firefox ESR Fixed in

Download Mozilla Firefox 116.0.3