CVE-2023-25738

Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

08 Jun 2023, 16:10

Type Values Removed Values Added
References (MISC) https://www.mozilla.org/security/advisories/mfsa2023-07/ - (MISC) https://www.mozilla.org/security/advisories/mfsa2023-07/ - Vendor Advisory
References (MISC) https://bugzilla.mozilla.org/show_bug.cgi?id=1811852 - (MISC) https://bugzilla.mozilla.org/show_bug.cgi?id=1811852 - Issue Tracking, Permissions Required
References (MISC) https://www.mozilla.org/security/advisories/mfsa2023-05/ - (MISC) https://www.mozilla.org/security/advisories/mfsa2023-05/ - Vendor Advisory
References (MISC) https://www.mozilla.org/security/advisories/mfsa2023-06/ - (MISC) https://www.mozilla.org/security/advisories/mfsa2023-06/ - Vendor Advisory
CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
First Time Mozilla thunderbird
Mozilla
Mozilla firefox
Mozilla firefox Esr
Microsoft windows
Microsoft
CWE CWE-125
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 6.5

02 Jun 2023, 17:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-06-02 17:15

Updated : 2023-12-10 15:01


NVD link : CVE-2023-25738

Mitre link : CVE-2023-25738

CVE.ORG link : CVE-2023-25738


JSON object : View

Products Affected

mozilla

  • firefox_esr
  • firefox
  • thunderbird

microsoft

  • windows
CWE
CWE-125

Out-of-bounds Read