CVE-2023-32215

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Jun 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-322169.8Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bCVE-2023-322178.8IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 pCVE-2023-322186.1Avaya IX Workforce Engagement v15.2.7.1195 - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-322197.5A Mazda model (2015-2016) can be unlocked via an unspecified method.CVE-2023-32227.5Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote aCVE-2023-322209.8Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method.CVE-2023-322217.8EaseUS Todo Backup version 20220111.390 - An omission during installation may allow a local attacker to perform privilege escalation.CVE-2023-322229.8D-Link DSL-G256DG version vBZ_1.00.27 web management interface allows authentication bypass via an unspecified method.CVE-2023-322238.8D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method.CVE-2023-322249.8D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication AttemptsCVE-2023-322257.2Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type -  A malicious user with administrative privileges may be able to upload CVE-2023-322266.5Sysaid - CWE-552: Files or Directories Accessible to External Parties -  Authenticated users may exfiltrate files from the server via an u