Veracode Vulnerability DatabaseVERACODE:43461Denial Of Service (DoS)
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
31.6%
firefox-esr is vulnerable to Denial Of Service (DoS). This vulnerability occurs during log compilation. A Garbage Collection could lead to a use-after-free condition, enabling an attacker to write two NUL bytes and potentially trigger a crash that could be exploitable.
References
bugzilla.mozilla.org/show_bug.cgi?id=1851599
lists.debian.org/debian-lts-announce/2023/09/msg00034.html
lists.debian.org/debian-lts-announce/2023/10/msg00015.html
lists.fedoraproject.org/archives/list/[email protected]/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/
secdb.alpinelinux.org/edge/community.yaml
www.debian.org/security/2023/dsa-5506
www.debian.org/security/2023/dsa-5513
www.mozilla.org/security/advisories/mfsa2023-41/
www.mozilla.org/security/advisories/mfsa2023-42/
www.mozilla.org/security/advisories/mfsa2023-43/
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
31.6%