CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS
Percentile
41.6%
When accessing throttled streams, the count of available bytes needed to be
checked in the calling function to be within bounds. This may have lead
future code to be incorrect and vulnerable. This vulnerability affects
Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.
Author | Note |
---|---|
tyhicks | mozjs contains a copy of the SpiderMonkey JavaScript engine |
mdeslaur | starting with Ubuntu 22.04, the firefox package is just a script that installs the Firefox snap |
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | firefox | < 111.0+build2-0ubuntu0.18.04.1 | UNKNOWN |
ubuntu | 20.04 | noarch | firefox | < 111.0+build2-0ubuntu0.20.04.1 | UNKNOWN |
ubuntu | 18.04 | noarch | mozjs38 | < any | UNKNOWN |
ubuntu | 18.04 | noarch | mozjs52 | < any | UNKNOWN |
ubuntu | 20.04 | noarch | mozjs52 | < any | UNKNOWN |
ubuntu | 20.04 | noarch | mozjs68 | < any | UNKNOWN |
ubuntu | 22.04 | noarch | mozjs78 | < any | UNKNOWN |
ubuntu | 22.04 | noarch | mozjs91 | < any | UNKNOWN |
ubuntu | 18.04 | noarch | thunderbird | < 1:102.9.0+build1-0ubuntu0.18.04.1 | UNKNOWN |
ubuntu | 20.04 | noarch | thunderbird | < 1:102.9.0+build1-0ubuntu0.20.04.1 | UNKNOWN |
launchpad.net/bugs/cve/CVE-2023-25752
nvd.nist.gov/vuln/detail/CVE-2023-25752
security-tracker.debian.org/tracker/CVE-2023-25752
ubuntu.com/security/notices/USN-5954-1
ubuntu.com/security/notices/USN-5972-1
www.cve.org/CVERecord?id=CVE-2023-25752
www.mozilla.org/en-US/security/advisories/mfsa2023-09/#CVE-2023-25752
www.mozilla.org/en-US/security/advisories/mfsa2023-10/#CVE-2023-25752