CVE-2023-29536

HighCVSS 8.8/10Last modified Oct 23, 2026

Description

An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 112
Mozilla	Focus for Android	>= unspecified, < 112
Mozilla	Firefox ESR	>= unspecified, < 102.10
Mozilla	Firefox for Android	>= unspecified, < 112
Mozilla	Thunderbird	>= unspecified, < 102.10

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1821959Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-13/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-14/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-15/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1821959Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-13/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-14/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-15/Vendor Advisory

Timeline

Published: Jun 2, 2023
Last modified: Oct 23, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-295377.5Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vuln CVE-2023-295384.3Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> UR CVE-2023-295398.8When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL cha CVE-2023-29545.4Cross-site Scripting (XSS) - Stored in GitHub repository liangliangyy/djangoblog prior to master.CVE-2023-295406.1Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes wit CVE-2023-295418.8Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled comm CVE-2023-295429.8A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as CVE-2023-295438.8An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vect CVE-2023-295446.5If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a CVE-2023-295456.5Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have reso CVE-2023-295466.5When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking CVE-2023-295476.5When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have s