CVE-2023-37211

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Jul 5, 2023
Last modified
Oct 24, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-372128.8Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we presume that with enough effort soCVE-2023-372139.8Synel SYnergy Fingerprint Terminals - CWE-78: 'OS Command Injection'CVE-2023-372149.8Heights Telecom ERO1xS-Pro Dual-Band FW version BZ_ERO1XP.025.CVE-2023-372159.8JBL soundbar multibeam 5.1 - CWE-798: Use of Hard-coded CredentialsCVE-2023-372166.5AnaSystem SensMini M4 – Using the configuration tool, an authenticated user can cause Denial of Service for the deviceCVE-2023-372175.3Tadiran Telecom Aeonix - CWE-204: Observable Response DiscrepancyCVE-2023-372187.5Tadiran Telecom Aeonix - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-372197.8Tadiran Telecom Composit - CWE-1236: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-37229.8An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution asCVE-2023-372209.8Synel Terminals - CWE-494: Download of Code Without Integrity CheckCVE-2023-372216.17Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').CVE-2023-372224.8Farsight Tech Nordic AB ProVide version 14.5 - Multiple XSS vulnerabilities (CWE-79) can be exploited by a user with administrator privilege
CVE-2023-37211: High severity, CVSS 8.8 | Vulnix