CVE-2023-0767

Published: Jun 2, 2023Modified: May 5, 2025

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Affected (3)

Products: Mozilla: Firefox, Firefox Esr, Thunderbird

3 products

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Before 110.0
Mozilla Firefox Esr	Before 102.8
Mozilla Thunderbird	Before 102.8

References (11)

https://alas.aws.amazon.com/AL2/ALAS-2023-1992.html

Source: security@mozilla.org

Product

https://bugzilla.mozilla.org/show_bug.cgi?id=1804640

Source: security@mozilla.org

Issue TrackingPermissions RequiredVendor Advisory

https://www.mozilla.org/security/advisories/mfsa2023-05/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2023-06/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2023-07/

Source: security@mozilla.org

Vendor Advisory

https://alas.aws.amazon.com/AL2/ALAS-2023-1992.html