Every CVE Search/ Get API key

CVE-2023-4051

Full screen notification obscured by file open dialog

7.5 HighFix available

A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.66%Up 0.6 points since Aug 2, 2023
90%50%10%1%

What each source reports

NVD Score used 7.5

A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.

Record
CVE-2023-4051
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
CVE List No score

Full screen notification obscured by file open dialog

A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.

Record
CVE-2023-4051
Updated
2026-11-02
EUVDEUVD-2023-53942 No score

A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.

Record
EUVD-2023-53942
Updated
2026-11-02
GitHub AdvisoriesGHSA-w96m-wgv7-3r86 7.5

A website could have obscured the full screen notification by using the file open dialog. This...

A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116.

Record
GHSA-w96m-wgv7-3r86
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVALPINE-CVE-2023-4051 7.5

A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.

Record
ALPINE-CVE-2023-4051
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSV 7.5

A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.

Record
CVE-2023-4051
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 35 moreShow less
OSVDEBIAN-CVE-2023-4051 7.5

A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.

Record
DEBIAN-CVE-2023-4051
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2025-1265 9.8

firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions.

Security Fix(es):

When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata. This vulnerability affects Firefox < 103.(CVE-2022-36315)

When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the target URL had been subject to a redirect. This vulnerability affects Firefox < 103.(CVE-2022-36316)

An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was zero-length, the value was not written to an invalid memory address. This vulnerability affects Firefox < 104.(CVE-2022-38475)

Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited in Private Browsing Mode. This would not have persisted them in a state where they would run again, but it would have leaked Private Browsing Mode details to disk. This vulnerability affects Firefox < 107.(CVE-2022-45417)

If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certificate, and then deleted the exception, Firefox would have kept the connection alive, making it seem like the certificate was still trusted. This vulnerability affects Firefox < 107.(CVE-2022-45419)

Mozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 107. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108.(CVE-2022-46879)

Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 106. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.<br />Note: This advisory was added on December 13th, 2022 after discovering it was inadvertently left out of the original advisory. The fix was included in the original release of Firefox 107. This vulnerability affects Firefox < 107.(CVE-2022-46883)

Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox < 110.(CVE-2023-25731)

The return value from gfx::SourceSurfaceSkia::Map() wasn't being verified which could have potentially lead to a null pointer dereference. This vulnerability affects Firefox < 110.(CVE-2023-25733)

An invalid downcast from nsHTMLDocument to nsIContent could have lead to undefined behavior. This vulnerability affects Firefox < 110.(CVE-2023-25736)

Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode. This vulnerability affects Firefox < 111.(CVE-2023-25750)

When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking potentially sensitive information. This vulnerability affects Firefox < 111.(CVE-2023-28160)

Memory safety bugs present in Firefox 110. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 111.(CVE-2023-28177)

Multiple race conditions in the font initialization could have led to memory corruption…

Record
OESA-2025-1265
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-1268 9.8

firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions.

Security Fix(es):

When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata. This vulnerability affects Firefox < 103.(CVE-2022-36315)

When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the target URL had been subject to a redirect. This vulnerability affects Firefox < 103.(CVE-2022-36316)

An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was zero-length, the value was not written to an invalid memory address. This vulnerability affects Firefox < 104.(CVE-2022-38475)

Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited in Private Browsing Mode. This would not have persisted them in a state where they would run again, but it would have leaked Private Browsing Mode details to disk. This vulnerability affects Firefox < 107.(CVE-2022-45417)

If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certificate, and then deleted the exception, Firefox would have kept the connection alive, making it seem like the certificate was still trusted. This vulnerability affects Firefox < 107.(CVE-2022-45419)

Mozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 107. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108.(CVE-2022-46879)

Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 106. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.<br />Note: This advisory was added on December 13th, 2022 after discovering it was inadvertently left out of the original advisory. The fix was included in the original release of Firefox 107. This vulnerability affects Firefox < 107.(CVE-2022-46883)

Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox < 110.(CVE-2023-25731)

The return value from gfx::SourceSurfaceSkia::Map() wasn't being verified which could have potentially lead to a null pointer dereference. This vulnerability affects Firefox < 110.(CVE-2023-25733)

An invalid downcast from nsHTMLDocument to nsIContent could have lead to undefined behavior. This vulnerability affects Firefox < 110.(CVE-2023-25736)

Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode. This vulnerability affects Firefox < 111.(CVE-2023-25750)

When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking potentially sensitive information. This vulnerability affects Firefox < 111.(CVE-2023-28160)

Memory safety bugs present in Firefox 110. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 111.(CVE-2023-28177)

Multiple race conditions in the font initialization could have led to memory corruption…

Record
OESA-2025-1268
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:4945 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2023:4945
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:4946 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2023:4946
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:4947 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2023:4947
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:4948 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2023:4948
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:4949 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2023:4949
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:4950 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2023:4950
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:4951 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2023:4951
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:4952 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2023:4952
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:4954 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2023:4954
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:4955 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2023:4955
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:4956 8.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2023:4956
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:4957 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2023:4957
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:4958 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2023:4958
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:4959 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2023:4959
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:5019 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2023:5019
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2023:4952 8.8

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 102.15.0 ESR.

Security Fix(es):

  • Mozilla: Memory corruption in IPC CanvasTranslator (CVE-2023-4573)

  • Mozilla: Memory corruption in IPC ColorPickerShownCallback (CVE-2023-4574)

  • Mozilla: Memory corruption in IPC FilePickerShownCallback (CVE-2023-4575)

  • Mozilla: Memory corruption in JIT UpdateRegExpStatics (CVE-2023-4577)

  • Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (CVE-2023-4584)

  • Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2 (CVE-2023-4585)

  • Mozilla: Full screen notification obscured by file open dialog (CVE-2023-4051)

  • Mozilla: Full screen notification obscured by external program (CVE-2023-4053)

  • Mozilla: Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception (CVE-2023-4578)

  • Mozilla: Push notifications saved to disk unencrypted (CVE-2023-4580)

  • Mozilla: XLL file extensions were downloadable without warnings (CVE-2023-4581)

  • Mozilla: Browsing Context potentially not cleared when closing Private Window (CVE-2023-4583)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:4952
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2023:4954 8.8

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.15.0.

Security Fix(es):

  • Mozilla: Memory corruption in IPC CanvasTranslator (CVE-2023-4573)

  • Mozilla: Memory corruption in IPC ColorPickerShownCallback (CVE-2023-4574)

  • Mozilla: Memory corruption in IPC FilePickerShownCallback (CVE-2023-4575)

  • Mozilla: Memory corruption in JIT UpdateRegExpStatics (CVE-2023-4577)

  • Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (CVE-2023-4584)

  • Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2 (CVE-2023-4585)

  • Mozilla: Full screen notification obscured by file open dialog (CVE-2023-4051)

  • Mozilla: Full screen notification obscured by external program (CVE-2023-4053)

  • Mozilla: Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception (CVE-2023-4578)

  • Mozilla: Push notifications saved to disk unencrypted (CVE-2023-4580)

  • Mozilla: XLL file extensions were downloadable without warnings (CVE-2023-4581)

  • Mozilla: Browsing Context potentially not cleared when closing Private Window (CVE-2023-4583)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:4954
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-4051 7.5

A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.

Record
UBUNTU-CVE-2023-4051
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVALSA-2023:4952 No score

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 102.15.0 ESR.

Security Fix(es):

  • Mozilla: Memory corruption in IPC CanvasTranslator (CVE-2023-4573)
  • Mozilla: Memory corruption in IPC ColorPickerShownCallback (CVE-2023-4574)
  • Mozilla: Memory corruption in IPC FilePickerShownCallback (CVE-2023-4575)
  • Mozilla: Memory corruption in JIT UpdateRegExpStatics (CVE-2023-4577)
  • Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (CVE-2023-4584)
  • Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2 (CVE-2023-4585)
  • Mozilla: Full screen notification obscured by file open dialog (CVE-2023-4051)
  • Mozilla: Full screen notification obscured by external program (CVE-2023-4053)
  • Mozilla: Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception (CVE-2023-4578)
  • Mozilla: Push notifications saved to disk unencrypted (CVE-2023-4580)
  • Mozilla: XLL file extensions were downloadable without warnings (CVE-2023-4581)
  • Mozilla: Browsing Context potentially not cleared when closing Private Window (CVE-2023-4583)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:4952
Updated
2026-11-02
OSVALSA-2023:4954 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.15.0.

Security Fix(es):

  • Mozilla: Memory corruption in IPC CanvasTranslator (CVE-2023-4573)
  • Mozilla: Memory corruption in IPC ColorPickerShownCallback (CVE-2023-4574)
  • Mozilla: Memory corruption in IPC FilePickerShownCallback (CVE-2023-4575)
  • Mozilla: Memory corruption in JIT UpdateRegExpStatics (CVE-2023-4577)
  • Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (CVE-2023-4584)
  • Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2 (CVE-2023-4585)
  • Mozilla: Full screen notification obscured by file open dialog (CVE-2023-4051)
  • Mozilla: Full screen notification obscured by external program (CVE-2023-4053)
  • Mozilla: Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception (CVE-2023-4578)
  • Mozilla: Push notifications saved to disk unencrypted (CVE-2023-4580)
  • Mozilla: XLL file extensions were downloadable without warnings (CVE-2023-4581)
  • Mozilla: Browsing Context potentially not cleared when closing Private Window (CVE-2023-4583)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:4954
Updated
2026-11-02
OSVALSA-2023:4955 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.15.0.

Security Fix(es):

  • Mozilla: Memory corruption in IPC CanvasTranslator (CVE-2023-4573)
  • Mozilla: Memory corruption in IPC ColorPickerShownCallback (CVE-2023-4574)
  • Mozilla: Memory corruption in IPC FilePickerShownCallback (CVE-2023-4575)
  • Mozilla: Memory corruption in JIT UpdateRegExpStatics (CVE-2023-4577)
  • Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (CVE-2023-4584)
  • Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2 (CVE-2023-4585)
  • Mozilla: Full screen notification obscured by file open dialog (CVE-2023-4051)
  • Mozilla: Full screen notification obscured by external program (CVE-2023-4053)
  • Mozilla: Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception (CVE-2023-4578)
  • Mozilla: Push notifications saved to disk unencrypted (CVE-2023-4580)
  • Mozilla: XLL file extensions were downloadable without warnings (CVE-2023-4581)
  • Mozilla: Browsing Context potentially not cleared when closing Private Window (CVE-2023-4583)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:4955
Updated
2026-11-02
OSVALSA-2023:4958 No score

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 102.15.0 ESR.

Security Fix(es):

  • Mozilla: Memory corruption in IPC CanvasTranslator (CVE-2023-4573)
  • Mozilla: Memory corruption in IPC ColorPickerShownCallback (CVE-2023-4574)
  • Mozilla: Memory corruption in IPC FilePickerShownCallback (CVE-2023-4575)
  • Mozilla: Memory corruption in JIT UpdateRegExpStatics (CVE-2023-4577)
  • Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (CVE-2023-4584)
  • Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2 (CVE-2023-4585)
  • Mozilla: Full screen notification obscured by file open dialog (CVE-2023-4051)
  • Mozilla: Full screen notification obscured by external program (CVE-2023-4053)
  • Mozilla: Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception (CVE-2023-4578)
  • Mozilla: Push notifications saved to disk unencrypted (CVE-2023-4580)
  • Mozilla: XLL file extensions were downloadable without warnings (CVE-2023-4581)
  • Mozilla: Browsing Context potentially not cleared when closing Private Window (CVE-2023-4583)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:4958
Updated
2026-11-02
OSVMGASA-2023-0266 No score

Updated firefox/thunderbird packages fix security vulnerability

Use-after-free in workers. (CVE-2023-3600)

File Extension Spoofing using the Text Direction Override Character. (CVE-2023-3417)

Offscreen Canvas could have bypassed cross-origin restrictions. (CVE-2023-4045)

Incorrect value used during WASM compilation. (CVE-2023-4046)

Potential permissions request bypass via clickjacking. (CVE-2023-4047)

Crash in DOMParser due to out-of-memory conditions. (CVE-2023-4048)

Fix potential race conditions when releasing platform objects. (CVE-2023-4049)

Stack buffer overflow in StorageManager. (CVE-2023-4050)

Cookie jar overflow caused unexpected cookie jar state. (CVE-2023-4055)

Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14. (CVE-2023-4056)

Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. (CVE-2023-4057)

Memory corruption in IPC CanvasTranslator. (CVE-2023-4573)

Memory corruption in IPC ColorPickerShownCallback. (CVE-2023-4574)

Memory corruption in IPC FilePickerShownCallback. (CVE-2023-4575)

Integer Overflow in RecordedSourceSurfaceCreation. (CVE-2023-4576)

Memory corruption in JIT UpdateRegExpStatics. (CVE-2023-4577)

Full screen notification obscured by file open dialog. (CVE-2023-4051)

Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception. (CVE-2023-4578)

Full screen notification obscured by external program. (CVE-2023-4053)

Push notifications saved to disk unencrypted. (CVE-2023-4580)

XLL file extensions were downloadable without warnings. (CVE-2023-4581)

Browsing Context potentially not cleared when closing Private Window. (CVE-2023-4583)

Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2. (CVE-2023-4584)

Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. (CVE-2023-4585)

Heap buffer overflow in libwebp. (CVE-2023-4863)

Record
MGASA-2023-0266
Updated
2026-11-02
OSVopenSUSE-SU-2024:13124-1 No score

MozillaFirefox-116.0.2-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-116.0.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13124-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13197-1 No score

libmozjs-115-0-115.2.0-1.1 on GA media

These are all security issues fixed in the libmozjs-115-0-115.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13197-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13202-1 No score

MozillaThunderbird-115.2.0-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-115.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13202-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2023:3519-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Firefox was updated to Extended Support Release 115.2.0 ESR (MFSA 2023-36) (bsc#1214606).

  • CVE-2023-4574: Fixed memory corruption in IPC ColorPickerShownCallback (bmo#1846688)
  • CVE-2023-4575: Fixed memory corruption in IPC FilePickerShownCallback (bmo#1846689)
  • CVE-2023-4576: Fixed integer Overflow in RecordedSourceSurfaceCreation (bmo#1846694)
  • CVE-2023-4577: Fixed memory corruption in JIT UpdateRegExpStatics (bmo#1847397)
  • CVE-2023-4051: Fixed full screen notification obscured by file open dialog (bmo#1821884)
  • CVE-2023-4578: Fixed Out of Memory Exception in SpiderMonkey could have triggered an (bmo#1839007)
  • CVE-2023-4053: Fixed full screen notification obscured by external program (bmo#1839079)
  • CVE-2023-4580: Fixed push notifications saved to disk unencrypted (bmo#1843046)
  • CVE-2023-4581: Fixed XLL file extensions downloadable without warnings (bmo#1843758)
  • CVE-2023-4582: Fixed buffer Overflow in WebGL glGetProgramiv (bmo#1773874)
  • CVE-2023-4583: Fixed browsing Context potentially not cleared when closing Private Window (bmo#1842030)
  • CVE-2023-4584: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
  • CVE-2023-4585: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2(bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999).
Record
SUSE-SU-2023:3519-1
Updated
2026-11-02
OSVSUSE-SU-2023:3559-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Firefox was updated to Extended Support Release 115.2.0 ESR (MFSA 2023-36) (bsc#1214606).

  • CVE-2023-4574: Fixed memory corruption in IPC ColorPickerShownCallback (bmo#1846688)
  • CVE-2023-4575: Fixed memory corruption in IPC FilePickerShownCallback (bmo#1846689)
  • CVE-2023-4576: Fixed integer Overflow in RecordedSourceSurfaceCreation (bmo#1846694)
  • CVE-2023-4577: Fixed memory corruption in JIT UpdateRegExpStatics (bmo#1847397)
  • CVE-2023-4051: Fixed full screen notification obscured by file open dialog (bmo#1821884)
  • CVE-2023-4578: Fixed Out of Memory Exception in SpiderMonkey could have triggered an (bmo#1839007)
  • CVE-2023-4053: Fixed full screen notification obscured by external program (bmo#1839079)
  • CVE-2023-4580: Fixed push notifications saved to disk unencrypted (bmo#1843046)
  • CVE-2023-4581: Fixed XLL file extensions downloadable without warnings (bmo#1843758)
  • CVE-2023-4582: Fixed buffer Overflow in WebGL glGetProgramiv (bmo#1773874)
  • CVE-2023-4583: Fixed browsing Context potentially not cleared when closing Private Window (bmo#1842030)
  • CVE-2023-4584: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
  • CVE-2023-4585: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2(bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999).
Record
SUSE-SU-2023:3559-1
Updated
2026-11-02
OSVSUSE-SU-2023:3562-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Firefox was updated to Extended Support Release 115.2.0 ESR (MFSA 2023-36) (bsc#1214606).

  • CVE-2023-4574: Fixed memory corruption in IPC ColorPickerShownCallback (bmo#1846688)
  • CVE-2023-4575: Fixed memory corruption in IPC FilePickerShownCallback (bmo#1846689)
  • CVE-2023-4576: Fixed integer Overflow in RecordedSourceSurfaceCreation (bmo#1846694)
  • CVE-2023-4577: Fixed memory corruption in JIT UpdateRegExpStatics (bmo#1847397)
  • CVE-2023-4051: Fixed full screen notification obscured by file open dialog (bmo#1821884)
  • CVE-2023-4578: Fixed Out of Memory Exception in SpiderMonkey could have triggered an (bmo#1839007)
  • CVE-2023-4053: Fixed full screen notification obscured by external program (bmo#1839079)
  • CVE-2023-4580: Fixed push notifications saved to disk unencrypted (bmo#1843046)
  • CVE-2023-4581: Fixed XLL file extensions downloadable without warnings (bmo#1843758)
  • CVE-2023-4582: Fixed buffer Overflow in WebGL glGetProgramiv (bmo#1773874)
  • CVE-2023-4583: Fixed browsing Context potentially not cleared when closing Private Window (bmo#1842030)
  • CVE-2023-4584: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
  • CVE-2023-4585: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2(bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999).
Record
SUSE-SU-2023:3562-1
Updated
2026-11-02
OSVSUSE-SU-2023:3664-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

Security fixes:

  • Mozilla Thunderbird 115.2.2 (MFSA 2023-40, bsc#1215245)

    • CVE-2023-4863: Fixed heap buffer overflow in libwebp (bmo#1852649).

  • Mozilla Thunderbird 115.2 (MFSA 2023-38, bsc#1214606)

    • CVE-2023-4573: Memory corruption in IPC CanvasTranslator (bmo#1846687)
    • CVE-2023-4574: Memory corruption in IPC ColorPickerShownCallback (bmo#1846688)
    • CVE-2023-4575: Memory corruption in IPC FilePickerShownCallback (bmo#1846689)
    • CVE-2023-4576: Integer Overflow in RecordedSourceSurfaceCreation (bmo#1846694)
    • CVE-2023-4577: Memory corruption in JIT UpdateRegExpStatics (bmo#1847397)
    • CVE-2023-4051: Full screen notification obscured by file open dialog (bmo#1821884)
    • CVE-2023-4578: Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception (bmo#1839007)
    • CVE-2023-4053: Full screen notification obscured by external program (bmo#1839079)
    • CVE-2023-4580: Push notifications saved to disk unencrypted (bmo#1843046)
    • CVE-2023-4581: XLL file extensions were downloadable without warnings (bmo#1843758)
    • CVE-2023-4582: Buffer Overflow in WebGL glGetProgramiv (bmo#1773874)
    • CVE-2023-4583: Browsing Context potentially not cleared when closing Private Window (bmo#1842030)
    • CVE-2023-4584: Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    • CVE-2023-4585: Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2 (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)

Other fixes:

Mozilla Thunderbird 115.2.1

  • new: Column separators are now shown between all columns in tree view (bmo#1847441)
  • fixed: Crash reporter did not work in Thunderbird Flatpak (bmo#1843102)
  • fixed: New mail notification always opened message in message pane, even if pane was disabled (bmo#1840092)
  • fixed: After moving an IMAP message to another folder, the incorrect message was selected in the message list (bmo#1845376)
  • fixed: Adding a tag to an IMAP message opened in a tab failed (bmo#1844452)
  • fixed: Junk/Spam folders were not always shown in Unified Folders mode (bmo#1838672)
  • fixed: Middle-clicking a folder or message did not open it in a background tab, as in previous versions (bmo#1842482)
  • fixed: Settings tab visual improvements: Advanced Fonts dialog, Section headers hidden behind search box (bmo#1717382,bmo#1846751)
  • fixed: Various visual and style fixes (bmo#1843707,bmo#1849823)

Mozilla Thunderbird 115.2

  • new: Thunderbird MSIX packages are now published on archive.mozilla.org (bmo#1817657)
  • changed: Size, Unread, and Total columns are now right- aligned (bmo#1848604)
  • changed: Newsgroup names in message list header are now abbreviated (bmo#1833298)
  • fixed: Message compose window did not apply theme colors to menus (bmo#1845699)
  • fixed: Reading the second new message in a folder cleared the unread indicator of all other new messages (bmo#1839805)
  • fixed: Displayed counts of unread or flagged messages could become out-of-sync (bmo#1846860)
  • fixed: Deleting a message from the context menu with messages sorted in chronological order and smooth scroll enabled caused message list to scroll to top (bmo#1843462)
  • fixed: Repeatedly switching accounts in Subscribe dialog caused tree view to stop updating (bmo#1845593)
  • fixed: 'Ignore thread' caused message cards to display incorrectly in message list (bmo#1847966)
  • fixed: Creating tags from unified toolbar failed (bmo#1846336)
  • fixed: Cross-folder navigation using F and N did not work (bmo#1845011)
  • fixed: Account Manager did not resize to fit content, causing 'Close' button to become hidden outside bounds of dialog when too many accounts…
Record
SUSE-SU-2023:3664-1
Updated
2026-11-02
OSVUSN-6267-1 No score

firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2023-4047, CVE-2023-4048, CVE-2023-4049, CVE-2023-4051, CVE-2023-4053, CVE-2023-4055, CVE-2023-4056, CVE-2023-4057, CVE-2023-4058)

Max Vlasov discovered that Firefox Offscreen Canvas did not properly track cross-origin tainting. An attacker could potentially exploit this issue to access image data from another site in violation of same-origin policy. (CVE-2023-4045)

Alexander Guryanov discovered that Firefox did not properly update the value of a global variable in WASM JIT analysis in some circumstances. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2023-4046)

Mark Brand discovered that Firefox did not properly validate the size of an untrusted input stream. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2023-4050)

Record
USN-6267-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox-esr
Alpine:v3.18
 before 115.2.0-r0
115.2.0-r0
firefox-esr
Alpine:v3.19
 before 115.2.0-r0
115.2.0-r0
firefox-esr
Alpine:v3.20
 before 115.2.0-r0
115.2.0-r0
firefox-esr
Alpine:v3.21
 before 115.2.0-r0
115.2.0-r0
firefox-esr
Alpine:v3.22
 before 115.2.0-r0
115.2.0-r0
firefox-esr
Alpine:v3.23
 before 115.2.0-r0
115.2.0-r0
firefox
AlmaLinux:8
From an advisory covering 12 CVEs
 before 102.15.0-1.el8_8.alma
102.15.0-1.el8_8.alma
thunderbird
AlmaLinux:8
From an advisory covering 12 CVEs
 before 102.15.0-1.el8_8.alma
102.15.0-1.el8_8.alma
thunderbird
AlmaLinux:9
From an advisory covering 12 CVEs
 before 102.15.0-1.el9_2.alma
102.15.0-1.el9_2.alma
firefox
AlmaLinux:9
From an advisory covering 12 CVEs
 before 102.15.0-1.el9_2.alma
102.15.0-1.el9_2.alma
Show 135 moreShow less
Affected packages
PackageAffectedFixed
firefox-x11
AlmaLinux:9
From an advisory covering 12 CVEs
 before 102.15.0-1.el9_2.alma
102.15.0-1.el9_2.alma
firefox-esr
Debian:13
 before 115.2.0esr-1
115.2.0esr-1
firefox-esr
Debian:14
 before 115.2.0esr-1
115.2.0esr-1
thunderbird
Debian:13
 before 1:115.2.0-1
1:115.2.0-1
thunderbird
Debian:14
 before 1:115.2.0-1
1:115.2.0-1
rootcerts
Mageia:8
From an advisory covering 25 CVEs
 before 20230720.00-1.mga8
20230720.00-1.mga8
nss
Mageia:8
From an advisory covering 25 CVEs
 before 3.93.0-1.mga8
3.93.0-1.mga8
firefox
Mageia:8
From an advisory covering 25 CVEs
 before 102.15.1-1.mga8
102.15.1-1.mga8
firefox-l10n
Mageia:8
From an advisory covering 25 CVEs
 before 102.15.1-1.mga8
102.15.1-1.mga8
thunderbird
Mageia:8
From an advisory covering 25 CVEs
 before 102.15.1-1.mga8
102.15.1-1.mga8
thunderbird-l10n
Mageia:8
From an advisory covering 25 CVEs
 before 102.15.1-1.mga8
102.15.1-1.mga8
rootcerts
Mageia:9
From an advisory covering 25 CVEs
 before 20230720.00-1.mga9
20230720.00-1.mga9
nss
Mageia:9
From an advisory covering 25 CVEs
 before 3.93.0-1.mga9
3.93.0-1.mga9
firefox
Mageia:9
From an advisory covering 25 CVEs
 before 115.2.1-1.mga9
115.2.1-1.mga9
firefox-l10n
Mageia:9
From an advisory covering 25 CVEs
 before 115.2.1-1.mga9
115.2.1-1.mga9
thunderbird
Mageia:9
From an advisory covering 25 CVEs
 before 115.2.2-1.mga9
115.2.2-1.mga9
thunderbird-l10n
Mageia:9
From an advisory covering 25 CVEs
 before 115.2.2-1.mga9
115.2.2-1.mga9
firefox
openEuler:22.03-LTS-SP4
From an advisory covering 187 CVEs
 before 128.8.0-1.oe2203sp4
128.8.0-1.oe2203sp4
firefox
openEuler:22.03-LTS-SP3
From an advisory covering 187 CVEs
 before 128.8.0-1.oe2203sp3
128.8.0-1.oe2203sp3
thunderbird
Red Hat:enterprise_linux:7::client
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el7_9
0:102.15.0-1.el7_9
thunderbird-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el7_9
0:102.15.0-1.el7_9
thunderbird
Red Hat:enterprise_linux:7::server
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el7_9
0:102.15.0-1.el7_9
thunderbird-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el7_9
0:102.15.0-1.el7_9
thunderbird
Red Hat:enterprise_linux:7::workstation
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el7_9
0:102.15.0-1.el7_9
thunderbird-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el7_9
0:102.15.0-1.el7_9
thunderbird
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
thunderbird-debuginfo
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
thunderbird-debugsource
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
thunderbird
Red Hat:rhel_e4s:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
thunderbird-debuginfo
Red Hat:rhel_e4s:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
thunderbird-debugsource
Red Hat:rhel_e4s:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
thunderbird
Red Hat:rhel_tus:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
thunderbird-debuginfo
Red Hat:rhel_tus:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
thunderbird-debugsource
Red Hat:rhel_tus:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
thunderbird
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el9_0
0:102.15.0-1.el9_0
thunderbird-debuginfo
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el9_0
0:102.15.0-1.el9_0
thunderbird-debugsource
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el9_0
0:102.15.0-1.el9_0
thunderbird
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_1
0:102.15.0-1.el8_1
thunderbird-debuginfo
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_1
0:102.15.0-1.el8_1
thunderbird-debugsource
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_1
0:102.15.0-1.el8_1
firefox
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_1
0:102.15.0-1.el8_1
firefox-debuginfo
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_1
0:102.15.0-1.el8_1
firefox-debugsource
Red Hat:rhel_e4s:8.1::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_1
0:102.15.0-1.el8_1
firefox
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el9_0
0:102.15.0-1.el9_0
firefox-debuginfo
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el9_0
0:102.15.0-1.el9_0
firefox-debugsource
Red Hat:rhel_eus:9.0::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el9_0
0:102.15.0-1.el9_0
firefox
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
firefox-debuginfo
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
firefox-debugsource
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
firefox
Red Hat:rhel_e4s:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
firefox-debuginfo
Red Hat:rhel_e4s:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
firefox-debugsource
Red Hat:rhel_e4s:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
firefox
Red Hat:rhel_tus:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
firefox-debuginfo
Red Hat:rhel_tus:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
firefox-debugsource
Red Hat:rhel_tus:8.2::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_2
0:102.15.0-1.el8_2
firefox
Red Hat:enterprise_linux:8::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_8
0:102.15.0-1.el8_8
firefox-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_8
0:102.15.0-1.el8_8
firefox-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_8
0:102.15.0-1.el8_8
thunderbird
Red Hat:enterprise_linux:8::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_8
0:102.15.0-1.el8_8
thunderbird-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_8
0:102.15.0-1.el8_8
thunderbird-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_8
0:102.15.0-1.el8_8
thunderbird
Red Hat:enterprise_linux:9::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el9_2
0:102.15.0-1.el9_2
thunderbird-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el9_2
0:102.15.0-1.el9_2
thunderbird-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el9_2
0:102.15.0-1.el9_2
thunderbird
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
thunderbird-debuginfo
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
thunderbird-debugsource
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
thunderbird
Red Hat:rhel_e4s:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
thunderbird-debuginfo
Red Hat:rhel_e4s:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
thunderbird-debugsource
Red Hat:rhel_e4s:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
thunderbird
Red Hat:rhel_tus:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
thunderbird-debuginfo
Red Hat:rhel_tus:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
thunderbird-debugsource
Red Hat:rhel_tus:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
firefox
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
firefox-debuginfo
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
firefox-debugsource
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
firefox
Red Hat:rhel_e4s:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
firefox-debuginfo
Red Hat:rhel_e4s:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
firefox-debugsource
Red Hat:rhel_e4s:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
firefox
Red Hat:rhel_tus:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
firefox-debuginfo
Red Hat:rhel_tus:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
firefox-debugsource
Red Hat:rhel_tus:8.4::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_4
0:102.15.0-1.el8_4
firefox
Red Hat:enterprise_linux:9::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el9_2
0:102.15.0-1.el9_2
firefox-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el9_2
0:102.15.0-1.el9_2
firefox-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el9_2
0:102.15.0-1.el9_2
firefox-x11
Red Hat:enterprise_linux:9::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el9_2
0:102.15.0-1.el9_2
firefox
Red Hat:rhel_eus:8.6::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_6
0:102.15.0-1.el8_6
firefox-debuginfo
Red Hat:rhel_eus:8.6::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_6
0:102.15.0-1.el8_6
firefox-debugsource
Red Hat:rhel_eus:8.6::appstream
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_6
0:102.15.0-1.el8_6
firefox
Red Hat:enterprise_linux:7::client
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el7_9
0:102.15.0-1.el7_9
firefox-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el7_9
0:102.15.0-1.el7_9
firefox
Red Hat:enterprise_linux:7::server
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el7_9
0:102.15.0-1.el7_9
firefox-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el7_9
0:102.15.0-1.el7_9
firefox
Red Hat:enterprise_linux:7::workstation
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el7_9
0:102.15.0-1.el7_9
firefox-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el7_9
0:102.15.0-1.el7_9
firefox
Rocky Linux:8
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_8
0:102.15.0-1.el8_8
thunderbird
Rocky Linux:8
From an advisory covering 12 CVEs
 before 0:102.15.0-1.el8_8
0:102.15.0-1.el8_8
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP4
From an advisory covering 13 CVEs
 before 115.2.0-150200.152.102.1
115.2.0-150200.152.102.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP5
From an advisory covering 13 CVEs
 before 115.2.0-150200.152.102.1
115.2.0-150200.152.102.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 13 CVEs
 before 115.2.0-150200.152.102.1
115.2.0-150200.152.102.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
From an advisory covering 13 CVEs
 before 115.2.0-150200.152.102.1
115.2.0-150200.152.102.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 13 CVEs
 before 115.2.0-150200.152.102.1
115.2.0-150200.152.102.1
MozillaFirefox
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 13 CVEs
 before 115.2.0-150200.152.102.1
115.2.0-150200.152.102.1
MozillaFirefox
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 13 CVEs
 before 115.2.0-150200.152.102.1
115.2.0-150200.152.102.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 13 CVEs
 before 115.2.0-150200.152.102.1
115.2.0-150200.152.102.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 13 CVEs
 before 115.2.0-150200.152.102.1
115.2.0-150200.152.102.1
MozillaFirefox
SUSE:Enterprise Storage 7
From an advisory covering 13 CVEs
 before 115.2.0-150200.152.102.1
115.2.0-150200.152.102.1
MozillaFirefox
SUSE:Enterprise Storage 7.1
From an advisory covering 13 CVEs
 before 115.2.0-150200.152.102.1
115.2.0-150200.152.102.1
MozillaFirefox
openSUSE:Leap 15.4
From an advisory covering 13 CVEs
 before 115.2.0-150200.152.102.1
115.2.0-150200.152.102.1
MozillaFirefox
openSUSE:Leap 15.5
From an advisory covering 13 CVEs
 before 115.2.0-150200.152.102.1
115.2.0-150200.152.102.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 13 CVEs
 before 115.2.0-112.176.1
115.2.0-112.176.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 13 CVEs
 before 115.2.0-112.176.1
115.2.0-112.176.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 13 CVEs
 before 115.2.0-112.176.1
115.2.0-112.176.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 13 CVEs
 before 115.2.0-150000.150.100.1
115.2.0-150000.150.100.1
MozillaFirefox
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 13 CVEs
 before 115.2.0-150000.150.100.1
115.2.0-150000.150.100.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 13 CVEs
 before 115.2.0-150000.150.100.1
115.2.0-150000.150.100.1
MozillaThunderbird
SUSE:Linux Enterprise Module for Package Hub 15 SP4
From an advisory covering 15 CVEs
 before 115.2.2-150200.8.130.1
115.2.2-150200.8.130.1
MozillaThunderbird
SUSE:Linux Enterprise Module for Package Hub 15 SP5
From an advisory covering 15 CVEs
 before 115.2.2-150200.8.130.1
115.2.2-150200.8.130.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP4
From an advisory covering 15 CVEs
 before 115.2.2-150200.8.130.1
115.2.2-150200.8.130.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP5
From an advisory covering 15 CVEs
 before 115.2.2-150200.8.130.1
115.2.2-150200.8.130.1
MozillaThunderbird
openSUSE:Leap 15.4
From an advisory covering 15 CVEs
 before 115.2.2-150200.8.130.1
115.2.2-150200.8.130.1
MozillaThunderbird
openSUSE:Leap 15.5
From an advisory covering 15 CVEs
 before 115.2.2-150200.8.130.1
115.2.2-150200.8.130.1
mozjs52
Ubuntu:18.04:LTS
 All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
 None known
mozjs38
Ubuntu:18.04:LTS
 All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
 None known
firefox
Ubuntu:20.04:LTS
 before 116.0+build2-0ubuntu0.20.04.2, plus listed versions
69.0.3+build1-0ubuntu170.0+build2-0ubuntu170.0+build2-0ubuntu270.0.1+build1-0ubuntu271.0+build2-0ubuntu2
Show 45 moreShow less
71.0+build5-0ubuntu172.0.1+build1-0ubuntu172.0.2+build1-0ubuntu173.0+build1-0ubuntu173.0+build2-0ubuntu173.0+build3-0ubuntu173.0.1+build1-0ubuntu174.0+build1-0ubuntu174.0+build2-0ubuntu174.0+build2-0ubuntu274.0+build3-0ubuntu175.0+build3-0ubuntu176.0+build2-0ubuntu0.20.04.176.0.1+build1-0ubuntu0.20.04.177.0.1+build1-0ubuntu0.20.04.178.0.1+build1-0ubuntu0.20.04.178.0.2+build2-0ubuntu0.20.04.179.0+build1-0ubuntu0.20.04.180.0+build2-0ubuntu0.20.04.180.0.1+build1-0ubuntu0.20.04.181.0+build2-0ubuntu0.20.04.181.0.2+build1-0ubuntu0.20.04.182.0+build2-0ubuntu0.20.04.182.0.2+build1-0ubuntu0.20.04.182.0.3+build1-0ubuntu0.20.04.183.0+build2-0ubuntu0.20.04.184.0+build3-0ubuntu0.20.04.184.0.1+build1-0ubuntu0.20.04.184.0.2+build1-0ubuntu0.20.04.185.0+build1-0ubuntu0.20.04.185.0.1+build1-0ubuntu0.20.04.186.0+build3-0ubuntu0.20.04.186.0.1+build1-0ubuntu0.20.04.187.0+build3-0ubuntu0.20.04.288.0+build2-0ubuntu0.20.04.188.0.1+build1-0ubuntu0.20.04.289.0+build2-0ubuntu0.20.04.289.0.1+build1-0ubuntu0.20.04.189.0.2+build1-0ubuntu0.20.04.190.0+build1-0ubuntu0.20.04.190.0.2+build1-0ubuntu0.20.04.191.0+build2-0ubuntu0.20.04.191.0.1+build1-0ubuntu0.20.04.191.0.2+build1-0ubuntu0.20.04.192.0+build3-0ubuntu0.20.04.1
116.0+build2-0ubuntu0.20.04.2
mozjs68
Ubuntu:20.04:LTS
 All versions, plus listed versions
68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1
 None known
mozjs52
Ubuntu:20.04:LTS
 All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
 None known
mozjs102
Ubuntu:22.04:LTS
 All versions, plus listed versions
102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1
 None known
mozjs78
Ubuntu:22.04:LTS
 All versions, plus listed versions
78.13.0-178.15.0-278.15.0-4ubuntu1
 None known
mozjs91
Ubuntu:22.04:LTS
 All versions, plus listed versions
91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1
 None known
mozjs102
Ubuntu:24.04:LTS
 All versions, plus listed versions
102.15.1-1102.15.1-3ubuntu2
 None known
firefox
Ubuntu:20.04:LTS
From an advisory covering 12 CVEs
 before 116.0+build2-0ubuntu0.20.04.2, plus listed versions
69.0.3+build1-0ubuntu170.0+build2-0ubuntu170.0+build2-0ubuntu270.0.1+build1-0ubuntu271.0+build2-0ubuntu2
Show 45 moreShow less
71.0+build5-0ubuntu172.0.1+build1-0ubuntu172.0.2+build1-0ubuntu173.0+build1-0ubuntu173.0+build2-0ubuntu173.0+build3-0ubuntu173.0.1+build1-0ubuntu174.0+build1-0ubuntu174.0+build2-0ubuntu174.0+build2-0ubuntu274.0+build3-0ubuntu175.0+build3-0ubuntu176.0+build2-0ubuntu0.20.04.176.0.1+build1-0ubuntu0.20.04.177.0.1+build1-0ubuntu0.20.04.178.0.1+build1-0ubuntu0.20.04.178.0.2+build2-0ubuntu0.20.04.179.0+build1-0ubuntu0.20.04.180.0+build2-0ubuntu0.20.04.180.0.1+build1-0ubuntu0.20.04.181.0+build2-0ubuntu0.20.04.181.0.2+build1-0ubuntu0.20.04.182.0+build2-0ubuntu0.20.04.182.0.2+build1-0ubuntu0.20.04.182.0.3+build1-0ubuntu0.20.04.183.0+build2-0ubuntu0.20.04.184.0+build3-0ubuntu0.20.04.184.0.1+build1-0ubuntu0.20.04.184.0.2+build1-0ubuntu0.20.04.185.0+build1-0ubuntu0.20.04.185.0.1+build1-0ubuntu0.20.04.186.0+build3-0ubuntu0.20.04.186.0.1+build1-0ubuntu0.20.04.187.0+build3-0ubuntu0.20.04.288.0+build2-0ubuntu0.20.04.188.0.1+build1-0ubuntu0.20.04.289.0+build2-0ubuntu0.20.04.289.0.1+build1-0ubuntu0.20.04.189.0.2+build1-0ubuntu0.20.04.190.0+build1-0ubuntu0.20.04.190.0.2+build1-0ubuntu0.20.04.191.0+build2-0ubuntu0.20.04.191.0.1+build1-0ubuntu0.20.04.191.0.2+build1-0ubuntu0.20.04.192.0+build3-0ubuntu0.20.04.1
116.0+build2-0ubuntu0.20.04.2
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 116.0.2-1.1
116.0.2-1.1
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 16 CVEs
 before 115.2.0-1.1
115.2.0-1.1
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
 before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-4051 is a high vulnerability (CVSS 7.5) in Mozilla Firefox, published August 1, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. Fixed in firefox-esr 115.2.0-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 82 versions, 1,992 references and the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open