CVE-2023-4056

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 116
Mozilla	Firefox ESR	>= unspecified, < 102.14
Mozilla	Firefox ESR	>= unspecified, < 115.1
mozilla	firefox	< 116
mozilla	firefox_esr	< 102.14; < 115.1

References

https://bugzilla.mozilla.org/buglist.cgi?bug_id=1820587%2C1824634%2C1839235%2C1842325%2C1843847Broken Link, Issue Tracking
https://lists.debian.org/debian-lts-announce/2023/08/msg00008.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/08/msg00010.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2023/dsa-5464Mailing List, Third Party Advisory
https://www.debian.org/security/2023/dsa-5469Mailing List, Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2023-29/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-30/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-31/Vendor Advisory
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1820587%2C1824634%2C1839235%2C1842325%2C1843847Broken Link, Issue Tracking
https://lists.debian.org/debian-lts-announce/2023/08/msg00008.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/08/msg00010.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2023/dsa-5464Mailing List, Third Party Advisory
https://www.debian.org/security/2023/dsa-5469Mailing List, Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2023-29/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-30/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-31/Vendor Advisory

Timeline

Published: Aug 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-405604.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Greg Ross Schedule Posts Calendar plugin <= 5.2 versions.CVE-2023-405618.8Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Enhanced Ecommerce Google Analytics for WooCommerce plugin <= 3.7.1 versions.CVE-2023-405679.8FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a CVE-2023-405699.8FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a CVE-2023-40579.8Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence of memory corruption CVE-2023-405705.3Datasette is an open source multi-tool for exploring and publishing data. This bug affects Datasette instances running a Datasette 1.0 alpha CVE-2023-405719.8weblogic-framework is a tool for detecting weblogic vulnerabilities. Versions 0.2.3 and prior do not verify the returned data packets, and t CVE-2023-405728.0XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to CVE-2023-405738.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that CVE-2023-405749.8FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a CVE-2023-405759.1FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a CVE-2023-405767.5FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a