CVE-2023-25738CWE-125

CVE-2023-25738

Medium · published June 2, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
49.8
In the wild
Unconfirmed
What it is

Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00635 · 49.8th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2023-06-02T21:15Z
Affected products (3)
ProductVersionsFixed in
mozilla/firefox< 110.0110.0
mozilla/firefox_esr< 102.8102.8
mozilla/thunderbird< 102.8102.8
References (9)
https://bugzilla.mozilla.org/show_bug.cgi?id=1811852 · [email protected]https://www.mozilla.org/security/advisories/mfsa2023-05/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2023-06/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2023-07/ · [email protected]https://bugzilla.mozilla.org/show_bug.cgi?id=1811852 · af854a3a-2127-422b-91ae-364da2661108https://www.mozilla.org/security/advisories/mfsa2023-05/ · af854a3a-2127-422b-91ae-364da2661108https://www.mozilla.org/security/advisories/mfsa2023-06/ · af854a3a-2127-422b-91ae-364da2661108https://www.mozilla.org/security/advisories/mfsa2023-07/ · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.mozilla.org/show_bug.cgi?id=1811852 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 JUN 00:00Z
    Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn…
    cvelistv5