CVE-2023-0767

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 110
Mozilla	Thunderbird	>= unspecified, < 102.8
Mozilla	Firefox ESR	>= unspecified, < 102.8

References

https://alas.aws.amazon.com/AL2/ALAS-2023-1992.htmlProduct
https://bugzilla.mozilla.org/show_bug.cgi?id=1804640Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-05/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-06/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-07/Vendor Advisory
https://alas.aws.amazon.com/AL2/ALAS-2023-1992.htmlProduct
https://bugzilla.mozilla.org/show_bug.cgi?id=1804640Issue Tracking, Permissions Required, Vendor Advisory
https://security.netapp.com/advisory/ntap-20230324-0008/
https://www.mozilla.org/security/advisories/mfsa2023-05/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-06/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-07/Vendor Advisory

Timeline

Published: Jun 2, 2023
Last modified: Oct 24, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-07688.8The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortcode attributes before CVE-2023-07696.1The hiWeb Migration Simple WordPress plugin through 2.0.0.1 does not sanitise and escape a parameter before outputting it back in the page, CVE-2023-07707.8Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.CVE-2023-07718.8SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop.CVE-2023-07726.5The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actua CVE-2023-07739.8The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remo CVE-2023-07749.8A vulnerability has been found in SourceCodester Medical Certificate Generator App 1.0 and classified as critical. This vulnerability affect CVE-2023-07756.5An invalid ‘prepare write request’ command can cause the Bluetooth LE stack to run out of memory and fail to be able to handle subsequent co CVE-2023-077610.0Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote CVE-2023-07779.8Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.CVE-2023-07786.8A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume wi CVE-2023-07797.7At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, fur