CVE-2023-34416

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Mozilla	Firefox ESR	>= unspecified, < 102.12
Mozilla	Firefox	>= unspecified, < 114
Mozilla	Thunderbird	>= unspecified, < 102.12

References

Timeline

Published: Jun 19, 2023
Last modified: Oct 24, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-344179.8Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so CVE-2023-344188.1A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vuln CVE-2023-344196.7A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local acc CVE-2023-34427.5A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited suc CVE-2023-344207.2A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web CVE-2023-344216.5A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call CVE-2023-344226.5A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafte CVE-2023-344236.1Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script ma CVE-2023-344244.4Improper input validation in firmware for some Intel(R) CSME may allow a privileged user to potentially enable denial of service via local a CVE-2023-344259.8The issue was addressed with improved memory handling. This issue is fixed in watchOS 9.6, macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7 CVE-2023-344269.8A stack-based buffer overflow vulnerability exists in the httpd manage_request functionality of Yifan YF325 v1.0_20221108. A specially craft CVE-2023-344277.8Protection mechanism failure in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an aut