CVE-2023-29543: mozilla firefox Use After Free
CVSS: 8.8v3.1HighModified
AliasesUBUNTU-CVE-2023-29543
Published 02-06-2023Last modified 10-01-2025
Vulnerability summary
CVE-2023-29543 is a high (CVSS 8.8) Use After Free vulnerability in mozilla firefox. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.3% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
0.53%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 02-06-2023PublishedVulnerability first disclosed.
- 10-01-2025Last modifiedVulnerability information updated.
Description
An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
CVSS metrics
3 scores · 3 sources · 1 versionHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
0.00 pp
From 0.52% on 18-09-2026
18-09-202618-10-2026
EPSS score0.53%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
- CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Affected systems
Ubuntu6 products
- firefox< 112.0+build2-0ubuntu0.18.04.1 | < 112.0+build2-0ubuntu0.20.04.1
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
- mozjs68All versions (No fix recorded)
- mozjs78All versions (No fix recorded)
Mozilla5 products
- firefox≥ unspecified, < 112 | < 112.0
- firefox for android≥ unspecified, < 112
- firefox_mobile< 112.0
- focus< 112.0
- focus for android≥ unspecified, < 112
2 vendors · 11 products
References
6 links- www.mozilla.org/security/advisories/mfsa2023-13/Vendor Advisory
- bugzilla.mozilla.org/show_bug.cgi?id=1816158Issue Tracking