CVE-2023-4582
Buffer Overflow in WebGL glGetProgramiv
Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occurred when allocating too much private shader memory on mac OS. This bug only affects Firefox on macOS. Other operating systems are unaffected. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occurred when allocating too much private shader memory on mac OS. This bug only affects Firefox on macOS. Other operating systems are unaffected. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
- Record
CVE-2023-4582- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
CVE List
Buffer Overflow in WebGL glGetProgramiv
Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occurred when allocating too much private shader memory on mac OS. This bug only affects Firefox on macOS. Other operating systems are unaffected. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
- Record
CVE-2023-4582- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2023-54436
Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occurred when allocating too much private shader memory on mac OS. This bug only affects Firefox on macOS. Other operating systems are unaffected. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
- Record
EUVD-2023-54436- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vqqw-c55h-3h3r
Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow...
Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occured when allocating too much private shader memory on mac OS. This bug only affects Firefox on macOS. Other operating systems are unaffected. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
- Record
GHSA-vqqw-c55h-3h3r- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-4582
Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occurred when allocating too much private shader memory on mac OS. This bug only affects Firefox on macOS. Other operating systems are unaffected. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
- Record
ALPINE-CVE-2023-4582- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVOESA-2025-1265
firefox security update
Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions.
Security Fix(es):
When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata. This vulnerability affects Firefox < 103.(CVE-2022-36315)
When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the target URL had been subject to a redirect. This vulnerability affects Firefox < 103.(CVE-2022-36316)
An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was zero-length, the value was not written to an invalid memory address. This vulnerability affects Firefox < 104.(CVE-2022-38475)
Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited in Private Browsing Mode. This would not have persisted them in a state where they would run again, but it would have leaked Private Browsing Mode details to disk. This vulnerability affects Firefox < 107.(CVE-2022-45417)
If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certificate, and then deleted the exception, Firefox would have kept the connection alive, making it seem like the certificate was still trusted. This vulnerability affects Firefox < 107.(CVE-2022-45419)
Mozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 107. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108.(CVE-2022-46879)
Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 106. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.<br />Note: This advisory was added on December 13th, 2022 after discovering it was inadvertently left out of the original advisory. The fix was included in the original release of Firefox 107. This vulnerability affects Firefox < 107.(CVE-2022-46883)
Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox < 110.(CVE-2023-25731)
The return value from gfx::SourceSurfaceSkia::Map() wasn't being verified which could have potentially lead to a null pointer dereference. This vulnerability affects Firefox < 110.(CVE-2023-25733)
An invalid downcast from nsHTMLDocument to nsIContent could have lead to undefined behavior. This vulnerability affects Firefox < 110.(CVE-2023-25736)
Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode. This vulnerability affects Firefox < 111.(CVE-2023-25750)
When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking potentially sensitive information. This vulnerability affects Firefox < 111.(CVE-2023-28160)
Memory safety bugs present in Firefox 110. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 111.(CVE-2023-28177)
Multiple race conditions in the font initialization could have led to memory corruption…
- Record
OESA-2025-1265- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVOESA-2025-1268
firefox security update
Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions.
Security Fix(es):
When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata. This vulnerability affects Firefox < 103.(CVE-2022-36315)
When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the target URL had been subject to a redirect. This vulnerability affects Firefox < 103.(CVE-2022-36316)
An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was zero-length, the value was not written to an invalid memory address. This vulnerability affects Firefox < 104.(CVE-2022-38475)
Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited in Private Browsing Mode. This would not have persisted them in a state where they would run again, but it would have leaked Private Browsing Mode details to disk. This vulnerability affects Firefox < 107.(CVE-2022-45417)
If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certificate, and then deleted the exception, Firefox would have kept the connection alive, making it seem like the certificate was still trusted. This vulnerability affects Firefox < 107.(CVE-2022-45419)
Mozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 107. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108.(CVE-2022-46879)
Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 106. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.<br />Note: This advisory was added on December 13th, 2022 after discovering it was inadvertently left out of the original advisory. The fix was included in the original release of Firefox 107. This vulnerability affects Firefox < 107.(CVE-2022-46883)
Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox < 110.(CVE-2023-25731)
The return value from gfx::SourceSurfaceSkia::Map() wasn't being verified which could have potentially lead to a null pointer dereference. This vulnerability affects Firefox < 110.(CVE-2023-25733)
An invalid downcast from nsHTMLDocument to nsIContent could have lead to undefined behavior. This vulnerability affects Firefox < 110.(CVE-2023-25736)
Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode. This vulnerability affects Firefox < 111.(CVE-2023-25750)
When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking potentially sensitive information. This vulnerability affects Firefox < 111.(CVE-2023-28160)
Memory safety bugs present in Firefox 110. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 111.(CVE-2023-28177)
Multiple race conditions in the font initialization could have led to memory corruption…
- Record
OESA-2025-1268- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13176-1No score
MozillaFirefox-117.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-117.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13176-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13197-1No score
libmozjs-115-0-115.2.0-1.1 on GA media
These are all security issues fixed in the libmozjs-115-0-115.2.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13197-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13202-1No score
MozillaThunderbird-115.2.0-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-115.2.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13202-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3519-1No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox was updated to Extended Support Release 115.2.0 ESR (MFSA 2023-36) (bsc#1214606).
- CVE-2023-4574: Fixed memory corruption in IPC ColorPickerShownCallback (bmo#1846688)
- CVE-2023-4575: Fixed memory corruption in IPC FilePickerShownCallback (bmo#1846689)
- CVE-2023-4576: Fixed integer Overflow in RecordedSourceSurfaceCreation (bmo#1846694)
- CVE-2023-4577: Fixed memory corruption in JIT UpdateRegExpStatics (bmo#1847397)
- CVE-2023-4051: Fixed full screen notification obscured by file open dialog (bmo#1821884)
- CVE-2023-4578: Fixed Out of Memory Exception in SpiderMonkey could have triggered an (bmo#1839007)
- CVE-2023-4053: Fixed full screen notification obscured by external program (bmo#1839079)
- CVE-2023-4580: Fixed push notifications saved to disk unencrypted (bmo#1843046)
- CVE-2023-4581: Fixed XLL file extensions downloadable without warnings (bmo#1843758)
- CVE-2023-4582: Fixed buffer Overflow in WebGL glGetProgramiv (bmo#1773874)
- CVE-2023-4583: Fixed browsing Context potentially not cleared when closing Private Window (bmo#1842030)
- CVE-2023-4584: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
- CVE-2023-4585: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2(bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999).
- Record
SUSE-SU-2023:3519-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3559-1No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox was updated to Extended Support Release 115.2.0 ESR (MFSA 2023-36) (bsc#1214606).
- CVE-2023-4574: Fixed memory corruption in IPC ColorPickerShownCallback (bmo#1846688)
- CVE-2023-4575: Fixed memory corruption in IPC FilePickerShownCallback (bmo#1846689)
- CVE-2023-4576: Fixed integer Overflow in RecordedSourceSurfaceCreation (bmo#1846694)
- CVE-2023-4577: Fixed memory corruption in JIT UpdateRegExpStatics (bmo#1847397)
- CVE-2023-4051: Fixed full screen notification obscured by file open dialog (bmo#1821884)
- CVE-2023-4578: Fixed Out of Memory Exception in SpiderMonkey could have triggered an (bmo#1839007)
- CVE-2023-4053: Fixed full screen notification obscured by external program (bmo#1839079)
- CVE-2023-4580: Fixed push notifications saved to disk unencrypted (bmo#1843046)
- CVE-2023-4581: Fixed XLL file extensions downloadable without warnings (bmo#1843758)
- CVE-2023-4582: Fixed buffer Overflow in WebGL glGetProgramiv (bmo#1773874)
- CVE-2023-4583: Fixed browsing Context potentially not cleared when closing Private Window (bmo#1842030)
- CVE-2023-4584: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
- CVE-2023-4585: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2(bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999).
- Record
SUSE-SU-2023:3559-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3562-1No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox was updated to Extended Support Release 115.2.0 ESR (MFSA 2023-36) (bsc#1214606).
- CVE-2023-4574: Fixed memory corruption in IPC ColorPickerShownCallback (bmo#1846688)
- CVE-2023-4575: Fixed memory corruption in IPC FilePickerShownCallback (bmo#1846689)
- CVE-2023-4576: Fixed integer Overflow in RecordedSourceSurfaceCreation (bmo#1846694)
- CVE-2023-4577: Fixed memory corruption in JIT UpdateRegExpStatics (bmo#1847397)
- CVE-2023-4051: Fixed full screen notification obscured by file open dialog (bmo#1821884)
- CVE-2023-4578: Fixed Out of Memory Exception in SpiderMonkey could have triggered an (bmo#1839007)
- CVE-2023-4053: Fixed full screen notification obscured by external program (bmo#1839079)
- CVE-2023-4580: Fixed push notifications saved to disk unencrypted (bmo#1843046)
- CVE-2023-4581: Fixed XLL file extensions downloadable without warnings (bmo#1843758)
- CVE-2023-4582: Fixed buffer Overflow in WebGL glGetProgramiv (bmo#1773874)
- CVE-2023-4583: Fixed browsing Context potentially not cleared when closing Private Window (bmo#1842030)
- CVE-2023-4584: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
- CVE-2023-4585: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2(bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999).
- Record
SUSE-SU-2023:3562-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3664-1No score
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
Security fixes:
Mozilla Thunderbird 115.2.2 (MFSA 2023-40, bsc#1215245)
- CVE-2023-4863: Fixed heap buffer overflow in libwebp (bmo#1852649).
Mozilla Thunderbird 115.2 (MFSA 2023-38, bsc#1214606)
- CVE-2023-4573: Memory corruption in IPC CanvasTranslator (bmo#1846687)
- CVE-2023-4574: Memory corruption in IPC ColorPickerShownCallback (bmo#1846688)
- CVE-2023-4575: Memory corruption in IPC FilePickerShownCallback (bmo#1846689)
- CVE-2023-4576: Integer Overflow in RecordedSourceSurfaceCreation (bmo#1846694)
- CVE-2023-4577: Memory corruption in JIT UpdateRegExpStatics (bmo#1847397)
- CVE-2023-4051: Full screen notification obscured by file open dialog (bmo#1821884)
- CVE-2023-4578: Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception (bmo#1839007)
- CVE-2023-4053: Full screen notification obscured by external program (bmo#1839079)
- CVE-2023-4580: Push notifications saved to disk unencrypted (bmo#1843046)
- CVE-2023-4581: XLL file extensions were downloadable without warnings (bmo#1843758)
- CVE-2023-4582: Buffer Overflow in WebGL glGetProgramiv (bmo#1773874)
- CVE-2023-4583: Browsing Context potentially not cleared when closing Private Window (bmo#1842030)
- CVE-2023-4584: Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
- CVE-2023-4585: Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2 (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
Other fixes:
Mozilla Thunderbird 115.2.1
- new: Column separators are now shown between all columns in tree view (bmo#1847441)
- fixed: Crash reporter did not work in Thunderbird Flatpak (bmo#1843102)
- fixed: New mail notification always opened message in message pane, even if pane was disabled (bmo#1840092)
- fixed: After moving an IMAP message to another folder, the incorrect message was selected in the message list (bmo#1845376)
- fixed: Adding a tag to an IMAP message opened in a tab failed (bmo#1844452)
- fixed: Junk/Spam folders were not always shown in Unified Folders mode (bmo#1838672)
- fixed: Middle-clicking a folder or message did not open it in a background tab, as in previous versions (bmo#1842482)
- fixed: Settings tab visual improvements: Advanced Fonts dialog, Section headers hidden behind search box (bmo#1717382,bmo#1846751)
- fixed: Various visual and style fixes (bmo#1843707,bmo#1849823)
Mozilla Thunderbird 115.2
- new: Thunderbird MSIX packages are now published on archive.mozilla.org (bmo#1817657)
- changed: Size, Unread, and Total columns are now right- aligned (bmo#1848604)
- changed: Newsgroup names in message list header are now abbreviated (bmo#1833298)
- fixed: Message compose window did not apply theme colors to menus (bmo#1845699)
- fixed: Reading the second new message in a folder cleared the unread indicator of all other new messages (bmo#1839805)
- fixed: Displayed counts of unread or flagged messages could become out-of-sync (bmo#1846860)
- fixed: Deleting a message from the context menu with messages sorted in chronological order and smooth scroll enabled caused message list to scroll to top (bmo#1843462)
- fixed: Repeatedly switching accounts in Subscribe dialog caused tree view to stop updating (bmo#1845593)
- fixed: 'Ignore thread' caused message cards to display incorrectly in message list (bmo#1847966)
- fixed: Creating tags from unified toolbar failed (bmo#1846336)
- fixed: Cross-folder navigation using F and N did not work (bmo#1845011)
- fixed: Account Manager did not resize to fit content, causing 'Close' button to become hidden outside bounds of dialog when too many accounts…
- Record
SUSE-SU-2023:3664-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefox-esrAlpine:v3.18 | before 115.2.0-r0 | 115.2.0-r0 |
firefox-esrAlpine:v3.19 | before 115.2.0-r0 | 115.2.0-r0 |
firefox-esrAlpine:v3.20 | before 115.2.0-r0 | 115.2.0-r0 |
firefox-esrAlpine:v3.21 | before 115.2.0-r0 | 115.2.0-r0 |
firefox-esrAlpine:v3.22 | before 115.2.0-r0 | 115.2.0-r0 |
firefox-esrAlpine:v3.23 | before 115.2.0-r0 | 115.2.0-r0 |
firefoxopenEuler:22.03-LTS-SP4 From an advisory covering 187 CVEs | before 128.8.0-1.oe2203sp4 | 128.8.0-1.oe2203sp4 |
firefoxopenEuler:22.03-LTS-SP3 From an advisory covering 187 CVEs | before 128.8.0-1.oe2203sp3 | 128.8.0-1.oe2203sp3 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP4 From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Enterprise Storage 7 From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Enterprise Storage 7.1 From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxopenSUSE:Leap 15.4 From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxopenSUSE:Leap 15.5 From an advisory covering 13 CVEs | before 115.2.0-150200.152.102.1 | 115.2.0-150200.152.102.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 13 CVEs | before 115.2.0-112.176.1 | 115.2.0-112.176.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 13 CVEs | before 115.2.0-112.176.1 | 115.2.0-112.176.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 13 CVEs | before 115.2.0-112.176.1 | 115.2.0-112.176.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 13 CVEs | before 115.2.0-150000.150.100.1 | 115.2.0-150000.150.100.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 13 CVEs | before 115.2.0-150000.150.100.1 | 115.2.0-150000.150.100.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 13 CVEs | before 115.2.0-150000.150.100.1 | 115.2.0-150000.150.100.1 |
MozillaThunderbirdSUSE:Linux Enterprise Module for Package Hub 15 SP4 From an advisory covering 15 CVEs | before 115.2.2-150200.8.130.1 | 115.2.2-150200.8.130.1 |
MozillaThunderbirdSUSE:Linux Enterprise Module for Package Hub 15 SP5 From an advisory covering 15 CVEs | before 115.2.2-150200.8.130.1 | 115.2.2-150200.8.130.1 |
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP4 From an advisory covering 15 CVEs | before 115.2.2-150200.8.130.1 | 115.2.2-150200.8.130.1 |
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP5 From an advisory covering 15 CVEs | before 115.2.2-150200.8.130.1 | 115.2.2-150200.8.130.1 |
MozillaThunderbirdopenSUSE:Leap 15.4 From an advisory covering 15 CVEs | before 115.2.2-150200.8.130.1 | 115.2.2-150200.8.130.1 |
MozillaThunderbirdopenSUSE:Leap 15.5 From an advisory covering 15 CVEs | before 115.2.2-150200.8.130.1 | 115.2.2-150200.8.130.1 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 13 CVEs | before 117.0-1.1 | 117.0-1.1 |
MozillaThunderbirdopenSUSE:Tumbleweed From an advisory covering 16 CVEs | before 115.2.0-1.1 | 115.2.0-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs | before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-4582 is a high vulnerability (CVSS 8.8) in Mozilla Firefox, published September 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in firefox-esr 115.2.0-r0.
References
bugzilla.mozilla.org/show_bug.cgi?id=1773874
mozilla.org/security/advisories/mfsa2023-34
nvd.nist.gov/vuln/detail/CVE-2023-4582
github.com/advisories/GHSA-vqqw-c55h-3h3r
Show 194 moreShow less
security.alpinelinux.org/vuln/CVE-2023-4582
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1265
suse.com/support/update/announcement/2023/suse-su-20233519-1
bugzilla.suse.com/1214606
lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V
Left out here: 1,864 references and the rest of 3 source descriptions. The JSON record has them.