CVE-2023-4577

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 117
Mozilla	Firefox ESR	>= unspecified, < 115.2
Mozilla	Thunderbird	>= unspecified, < 115.2

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1847397Issue Tracking, Permissions Required
https://www.mozilla.org/security/advisories/mfsa2023-34/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-36/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-38/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1847397Issue Tracking, Permissions Required
https://www.mozilla.org/security/advisories/mfsa2023-34/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-36/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-38/Vendor Advisory

Timeline

Published: Sep 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-457706.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fastwpspeed Fast WP Speed plugin <= 1.0.0 versions.CVE-2023-457717.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Contact Form With Captcha allows Refle CVE-2023-457726.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Scribit Proofreading plugin <= 1.0.11 versions.CVE-2023-457737.8In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local esc CVE-2023-457747.8In fixUpIncomingShortcutInfo of ShortcutService.java, there is a possible way to view another user's image due to a confused deputy. This co CVE-2023-457757.8In CreateAudioBroadcast of broadcaster.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local e CVE-2023-457767.8In CreateAudioBroadcast of broadcaster.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local e CVE-2023-457777.8In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activities using system privil CVE-2023-457797.8In the APEX module framework of AOSP, there is a possible malicious update to platform components due to improperly used crypto. This could CVE-2023-45786.5When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`. A path i CVE-2023-457807.3In Print Service, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of pr CVE-2023-457815.5In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information di