CVE-2023-25732

Description

When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated potentially leading to an out of bounds memory write. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

CVSS Metrics

• v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.15%• Percentile: 36%

Techniques & Countermeasures

• CWE-787•Out-of-bounds Write

  The product writes data past the end, or before the beginning, of the intended buffer.

Affected Systems

• mozilla•firefox

  < 110.0 | ≥ unspecified, < 110

• mozilla•firefox_esr

  < 102.8 | ≥ unspecified, < 102.8

• mozilla•thunderbird

  < 102.8 | ≥ unspecified, < 102.8

References (4)

• https://www.mozilla.org/security/advisories/mfsa2023-06/
• https://www.mozilla.org/security/advisories/mfsa2023-05/
• https://www.mozilla.org/security/advisories/mfsa2023-07/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1804564