CVE-2023-4576
Integer Overflow in RecordedSourceSurfaceCreation
On Windows, an integer overflow could occur in RecordedSourceSurfaceCreation which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape.
This bug only affects Firefox on Windows. Other operating systems are unaffected. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
On Windows, an integer overflow could occur in RecordedSourceSurfaceCreation which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape.
This bug only affects Firefox on Windows. Other operating systems are unaffected. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.
- Record
CVE-2023-4576- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-190
- Updated
- 2026-11-02
CVE ListNo score
Integer Overflow in RecordedSourceSurfaceCreation
On Windows, an integer overflow could occur in RecordedSourceSurfaceCreation which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape.
This bug only affects Firefox on Windows. Other operating systems are unaffected. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.
- Record
CVE-2023-4576- Updated
- 2026-11-02
EUVDEUVD-2023-54430No score
On Windows, an integer overflow could occur in RecordedSourceSurfaceCreation which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape.
This bug only affects Firefox on Windows. Other operating systems are unaffected. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.
- Record
EUVD-2023-54430- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qcr8-g46x-v65q
On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in...
On Windows, an integer overflow could occur in RecordedSourceSurfaceCreation which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape.
This bug only affects Firefox on Windows. Other operating systems are unaffected. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, and Thunderbird < 115.2.
- Record
GHSA-qcr8-g46x-v65q- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-4576
On Windows, an integer overflow could occur in RecordedSourceSurfaceCreation which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape.
This bug only affects Firefox on Windows. Other operating systems are unaffected. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.
- Record
ALPINE-CVE-2023-4576- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-03
OSVUBUNTU-CVE-2023-4576
On Windows, an integer overflow could occur in RecordedSourceSurfaceCreation which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape. This bug only affects Firefox on Windows. Other operating systems are unaffected. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.
- Record
UBUNTU-CVE-2023-4576- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
Show 10 moreShow less
OSVMGASA-2023-0266No score
Updated firefox/thunderbird packages fix security vulnerability
Use-after-free in workers. (CVE-2023-3600)
File Extension Spoofing using the Text Direction Override Character. (CVE-2023-3417)
Offscreen Canvas could have bypassed cross-origin restrictions. (CVE-2023-4045)
Incorrect value used during WASM compilation. (CVE-2023-4046)
Potential permissions request bypass via clickjacking. (CVE-2023-4047)
Crash in DOMParser due to out-of-memory conditions. (CVE-2023-4048)
Fix potential race conditions when releasing platform objects. (CVE-2023-4049)
Stack buffer overflow in StorageManager. (CVE-2023-4050)
Cookie jar overflow caused unexpected cookie jar state. (CVE-2023-4055)
Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14. (CVE-2023-4056)
Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. (CVE-2023-4057)
Memory corruption in IPC CanvasTranslator. (CVE-2023-4573)
Memory corruption in IPC ColorPickerShownCallback. (CVE-2023-4574)
Memory corruption in IPC FilePickerShownCallback. (CVE-2023-4575)
Integer Overflow in RecordedSourceSurfaceCreation. (CVE-2023-4576)
Memory corruption in JIT UpdateRegExpStatics. (CVE-2023-4577)
Full screen notification obscured by file open dialog. (CVE-2023-4051)
Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception. (CVE-2023-4578)
Full screen notification obscured by external program. (CVE-2023-4053)
Push notifications saved to disk unencrypted. (CVE-2023-4580)
XLL file extensions were downloadable without warnings. (CVE-2023-4581)
Browsing Context potentially not cleared when closing Private Window. (CVE-2023-4583)
Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2. (CVE-2023-4584)
Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. (CVE-2023-4585)
Heap buffer overflow in libwebp. (CVE-2023-4863)
- Record
MGASA-2023-0266- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13176-1No score
MozillaFirefox-117.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-117.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13176-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13196-1No score
libmozjs-102-0-102.15.0-1.1 on GA media
These are all security issues fixed in the libmozjs-102-0-102.15.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13196-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13197-1No score
libmozjs-115-0-115.2.0-1.1 on GA media
These are all security issues fixed in the libmozjs-115-0-115.2.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13197-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13202-1No score
MozillaThunderbird-115.2.0-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-115.2.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13202-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3519-1No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox was updated to Extended Support Release 115.2.0 ESR (MFSA 2023-36) (bsc#1214606).
- CVE-2023-4574: Fixed memory corruption in IPC ColorPickerShownCallback (bmo#1846688)
- CVE-2023-4575: Fixed memory corruption in IPC FilePickerShownCallback (bmo#1846689)
- CVE-2023-4576: Fixed integer Overflow in RecordedSourceSurfaceCreation (bmo#1846694)
- CVE-2023-4577: Fixed memory corruption in JIT UpdateRegExpStatics (bmo#1847397)
- CVE-2023-4051: Fixed full screen notification obscured by file open dialog (bmo#1821884)
- CVE-2023-4578: Fixed Out of Memory Exception in SpiderMonkey could have triggered an (bmo#1839007)
- CVE-2023-4053: Fixed full screen notification obscured by external program (bmo#1839079)
- CVE-2023-4580: Fixed push notifications saved to disk unencrypted (bmo#1843046)
- CVE-2023-4581: Fixed XLL file extensions downloadable without warnings (bmo#1843758)
- CVE-2023-4582: Fixed buffer Overflow in WebGL glGetProgramiv (bmo#1773874)
- CVE-2023-4583: Fixed browsing Context potentially not cleared when closing Private Window (bmo#1842030)
- CVE-2023-4584: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
- CVE-2023-4585: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2(bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999).
- Record
SUSE-SU-2023:3519-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3559-1No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox was updated to Extended Support Release 115.2.0 ESR (MFSA 2023-36) (bsc#1214606).
- CVE-2023-4574: Fixed memory corruption in IPC ColorPickerShownCallback (bmo#1846688)
- CVE-2023-4575: Fixed memory corruption in IPC FilePickerShownCallback (bmo#1846689)
- CVE-2023-4576: Fixed integer Overflow in RecordedSourceSurfaceCreation (bmo#1846694)
- CVE-2023-4577: Fixed memory corruption in JIT UpdateRegExpStatics (bmo#1847397)
- CVE-2023-4051: Fixed full screen notification obscured by file open dialog (bmo#1821884)
- CVE-2023-4578: Fixed Out of Memory Exception in SpiderMonkey could have triggered an (bmo#1839007)
- CVE-2023-4053: Fixed full screen notification obscured by external program (bmo#1839079)
- CVE-2023-4580: Fixed push notifications saved to disk unencrypted (bmo#1843046)
- CVE-2023-4581: Fixed XLL file extensions downloadable without warnings (bmo#1843758)
- CVE-2023-4582: Fixed buffer Overflow in WebGL glGetProgramiv (bmo#1773874)
- CVE-2023-4583: Fixed browsing Context potentially not cleared when closing Private Window (bmo#1842030)
- CVE-2023-4584: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
- CVE-2023-4585: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2(bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999).
- Record
SUSE-SU-2023:3559-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3562-1No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox was updated to Extended Support Release 115.2.0 ESR (MFSA 2023-36) (bsc#1214606).
- CVE-2023-4574: Fixed memory corruption in IPC ColorPickerShownCallback (bmo#1846688)
- CVE-2023-4575: Fixed memory corruption in IPC FilePickerShownCallback (bmo#1846689)
- CVE-2023-4576: Fixed integer Overflow in RecordedSourceSurfaceCreation (bmo#1846694)
- CVE-2023-4577: Fixed memory corruption in JIT UpdateRegExpStatics (bmo#1847397)
- CVE-2023-4051: Fixed full screen notification obscured by file open dialog (bmo#1821884)
- CVE-2023-4578: Fixed Out of Memory Exception in SpiderMonkey could have triggered an (bmo#1839007)
- CVE-2023-4053: Fixed full screen notification obscured by external program (bmo#1839079)
- CVE-2023-4580: Fixed push notifications saved to disk unencrypted (bmo#1843046)
- CVE-2023-4581: Fixed XLL file extensions downloadable without warnings (bmo#1843758)
- CVE-2023-4582: Fixed buffer Overflow in WebGL glGetProgramiv (bmo#1773874)
- CVE-2023-4583: Fixed browsing Context potentially not cleared when closing Private Window (bmo#1842030)
- CVE-2023-4584: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
- CVE-2023-4585: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2(bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999).
- Record
SUSE-SU-2023:3562-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3664-1No score
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
Security fixes:
Mozilla Thunderbird 115.2.2 (MFSA 2023-40, bsc#1215245)
- CVE-2023-4863: Fixed heap buffer overflow in libwebp (bmo#1852649).
Mozilla Thunderbird 115.2 (MFSA 2023-38, bsc#1214606)
- CVE-2023-4573: Memory corruption in IPC CanvasTranslator (bmo#1846687)
- CVE-2023-4574: Memory corruption in IPC ColorPickerShownCallback (bmo#1846688)
- CVE-2023-4575: Memory corruption in IPC FilePickerShownCallback (bmo#1846689)
- CVE-2023-4576: Integer Overflow in RecordedSourceSurfaceCreation (bmo#1846694)
- CVE-2023-4577: Memory corruption in JIT UpdateRegExpStatics (bmo#1847397)
- CVE-2023-4051: Full screen notification obscured by file open dialog (bmo#1821884)
- CVE-2023-4578: Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception (bmo#1839007)
- CVE-2023-4053: Full screen notification obscured by external program (bmo#1839079)
- CVE-2023-4580: Push notifications saved to disk unencrypted (bmo#1843046)
- CVE-2023-4581: XLL file extensions were downloadable without warnings (bmo#1843758)
- CVE-2023-4582: Buffer Overflow in WebGL glGetProgramiv (bmo#1773874)
- CVE-2023-4583: Browsing Context potentially not cleared when closing Private Window (bmo#1842030)
- CVE-2023-4584: Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
- CVE-2023-4585: Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2 (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
Other fixes:
Mozilla Thunderbird 115.2.1
- new: Column separators are now shown between all columns in tree view (bmo#1847441)
- fixed: Crash reporter did not work in Thunderbird Flatpak (bmo#1843102)
- fixed: New mail notification always opened message in message pane, even if pane was disabled (bmo#1840092)
- fixed: After moving an IMAP message to another folder, the incorrect message was selected in the message list (bmo#1845376)
- fixed: Adding a tag to an IMAP message opened in a tab failed (bmo#1844452)
- fixed: Junk/Spam folders were not always shown in Unified Folders mode (bmo#1838672)
- fixed: Middle-clicking a folder or message did not open it in a background tab, as in previous versions (bmo#1842482)
- fixed: Settings tab visual improvements: Advanced Fonts dialog, Section headers hidden behind search box (bmo#1717382,bmo#1846751)
- fixed: Various visual and style fixes (bmo#1843707,bmo#1849823)
Mozilla Thunderbird 115.2
- new: Thunderbird MSIX packages are now published on archive.mozilla.org (bmo#1817657)
- changed: Size, Unread, and Total columns are now right- aligned (bmo#1848604)
- changed: Newsgroup names in message list header are now abbreviated (bmo#1833298)
- fixed: Message compose window did not apply theme colors to menus (bmo#1845699)
- fixed: Reading the second new message in a folder cleared the unread indicator of all other new messages (bmo#1839805)
- fixed: Displayed counts of unread or flagged messages could become out-of-sync (bmo#1846860)
- fixed: Deleting a message from the context menu with messages sorted in chronological order and smooth scroll enabled caused message list to scroll to top (bmo#1843462)
- fixed: Repeatedly switching accounts in Subscribe dialog caused tree view to stop updating (bmo#1845593)
- fixed: 'Ignore thread' caused message cards to display incorrectly in message list (bmo#1847966)
- fixed: Creating tags from unified toolbar failed (bmo#1846336)
- fixed: Cross-folder navigation using F and N did not work (bmo#1845011)
- fixed: Account Manager did not resize to fit content, causing 'Close' button to become hidden outside bounds of dialog when too many accounts…
- Record
SUSE-SU-2023:3664-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefox-esrAlpine:v3.18 | before 115.2.0-r0 | 115.2.0-r0 |
firefox-esrAlpine:v3.19 | before 115.2.0-r0 | 115.2.0-r0 |
firefox-esrAlpine:v3.20 | before 115.2.0-r0 | 115.2.0-r0 |
firefox-esrAlpine:v3.21 | before 115.2.0-r0 | 115.2.0-r0 |
firefox-esrAlpine:v3.22 | before 115.2.0-r0 | 115.2.0-r0 |
firefox-esrAlpine:v3.23 | before 115.2.0-r0 | 115.2.0-r0 |
rootcertsMageia:8 From an advisory covering 25 CVEs | before 20230720.00-1.mga8 | 20230720.00-1.mga8 |
nssMageia:8 From an advisory covering 25 CVEs | before 3.93.0-1.mga8 | 3.93.0-1.mga8 |
firefoxMageia:8 From an advisory covering 25 CVEs | before 102.15.1-1.mga8 | 102.15.1-1.mga8 |
firefox-l10nMageia:8 From an advisory covering 25 CVEs | before 102.15.1-1.mga8 | 102.15.1-1.mga8 |
Show 45 moreShow less
| Package | Affected | Fixed |
|---|---|---|
thunderbirdMageia:8 From an advisory covering 25 CVEs | before 102.15.1-1.mga8 | 102.15.1-1.mga8 |
thunderbird-l10nMageia:8 From an advisory covering 25 CVEs | before 102.15.1-1.mga8 | 102.15.1-1.mga8 |
rootcertsMageia:9 From an advisory covering 25 CVEs | before 20230720.00-1.mga9 | 20230720.00-1.mga9 |
nssMageia:9 From an advisory covering 25 CVEs | before 3.93.0-1.mga9 | 3.93.0-1.mga9 |
firefoxMageia:9 From an advisory covering 25 CVEs | before 115.2.1-1.mga9 | 115.2.1-1.mga9 |
firefox-l10nMageia:9 From an advisory covering 25 CVEs | before 115.2.1-1.mga9 | 115.2.1-1.mga9 |
thunderbirdMageia:9 From an advisory covering 25 CVEs | before 115.2.2-1.mga9 | 115.2.2-1.mga9 |
thunderbird-l10nMageia:9 From an advisory covering 25 CVEs | before 115.2.2-1.mga9 | 115.2.2-1.mga9 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP4 From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Enterprise Storage 7 From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Enterprise Storage 7.1 From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxopenSUSE:Leap 15.4 From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxopenSUSE:Leap 15.5 From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 13 CVEs | before 115.2.0-112.176.1 | 115.2.0-112.176.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 13 CVEs | before 115.2.0-112.176.1 | 115.2.0-112.176.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 13 CVEs | before 115.2.0-112.176.1 | 115.2.0-112.176.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 13 CVEs | before 115.2.0-150000.150.100.1 | 115.2.0-150000.150.100.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 13 CVEs | before 115.2.0-150000.150.100.1 | 115.2.0-150000.150.100.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 13 CVEs | before 115.2.0-150000.150.100.1 | 115.2.0-150000.150.100.1 |
MozillaThunderbirdSUSE:Linux Enterprise Module for Package Hub 15 SP4 From an advisory covering 15 CVEs | before 115.2.2-150200.8.130.1 | 115.2.2-150200.8.130.1 |
MozillaThunderbirdSUSE:Linux Enterprise Module for Package Hub 15 SP5 From an advisory covering 15 CVEs | before 115.2.2-150200.8.130.1 | 115.2.2-150200.8.130.1 |
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP4 From an advisory covering 15 CVEs | before 115.2.2-150200.8.130.1 | 115.2.2-150200.8.130.1 |
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP5 From an advisory covering 15 CVEs | before 115.2.2-150200.8.130.1 | 115.2.2-150200.8.130.1 |
MozillaThunderbirdopenSUSE:Leap 15.4 From an advisory covering 15 CVEs | before 115.2.2-150200.8.130.1 | 115.2.2-150200.8.130.1 |
MozillaThunderbirdopenSUSE:Leap 15.5 From an advisory covering 15 CVEs | before 115.2.2-150200.8.130.1 | 115.2.2-150200.8.130.1 |
mozjs52Ubuntu:18.04:LTS | All versions, plus listed versions 52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1 | None known |
mozjs38Ubuntu:18.04:LTS | All versions, plus listed versions 38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4 | None known |
mozjs68Ubuntu:20.04:LTS | All versions, plus listed versions 68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1 | None known |
mozjs52Ubuntu:20.04:LTS | All versions, plus listed versions 52.9.1-1build152.9.1-1ubuntu3 | None known |
firefoxUbuntu:22.04:LTS | All versions, plus listed versions 93.0+build1-0ubuntu394.0+build3-0ubuntu194.0.2+build1-0ubuntu194.0.2+build2-0ubuntu195.0+build1-0ubuntu1 Show 11 moreShow less95.0.1+build2-0ubuntu195.0.2+build1-0ubuntu196.0+build2-0ubuntu196.0.1+build1-0ubuntu196.0.2+build1-0ubuntu196.0.3+build1-0ubuntu197.0+build1-0ubuntu197.0+build2-0ubuntu197.0.1+build1-0ubuntu11:1snap1-0ubuntu11:1snap1-0ubuntu2 | None known |
mozjs102Ubuntu:22.04:LTS | All versions, plus listed versions 102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1 | None known |
mozjs78Ubuntu:22.04:LTS | All versions, plus listed versions 78.13.0-178.15.0-278.15.0-4ubuntu1 | None known |
mozjs91Ubuntu:22.04:LTS | All versions, plus listed versions 91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1 | None known |
thunderbirdUbuntu:22.04:LTS | All versions, plus listed versions 1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1 Show 34 moreShow less1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.11:140.7.1+build1-0ubuntu0.22.04.1 | None known |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 13 CVEs | before 117.0-1.1 | 117.0-1.1 |
MozillaThunderbirdopenSUSE:Tumbleweed From an advisory covering 16 CVEs | before 115.2.0-1.1 | 115.2.0-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs | before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-4576 is a high vulnerability (CVSS 8.6) in Mozilla Firefox, published September 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. Fixed in firefox-esr 115.2.0-r0.
References
bugzilla.mozilla.org/show_bug.cgi?id=1846694
mozilla.org/security/advisories/mfsa2023-34
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-4576
github.com/advisories/GHSA-qcr8-g46x-v65q
security.alpinelinux.org/vuln/CVE-2023-4576
advisories.mageia.org/MGASA-2023-0266.html
bugs.mageia.org/show_bug.cgi?id=32258
firefox-source-docs.mozilla.org/security/nss/releases/nss_3_93.html
thunderbird.net/en-US/thunderbird/115.0/releasenotes
suse.com/support/update/announcement/2023/suse-su-20233519-1
bugzilla.suse.com/1214606
ubuntu.com/security/CVE-2023-4576
cve.org/CVERecord?id=CVE-2023-4576
lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V
Left out here: 1,704 references and the rest of 1 source description. The JSON record has them.