Critical Memory Management Vulnerability in Firefox ESR and Thunderbird
Summary
DEBIAN-CVE-2023-4577: When UpdateRegExpStatics attempted to access initialStringHeap it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. Affects firefox-esr versions < 115.2.0esr-1. Fixed in 115.2.0esr-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Firefox ESR (Extended Support Release) and Thunderbird are widely used open-source applications developed by Mozilla. Firefox ESR is designed for organizations that need extended support for mass deployments, while Thunderbird is a popular email client. Both applications are known for their robust security features, but they are not immune to vulnerabilities. This specific vulnerability affects versions prior to Firefox ESR 115.2 and Thunderbird 115.2, potentially leading to crashes and exploitation due to improper memory management.
Vulnerability Detail
The vulnerability arises from the UpdateRegExpStatics function, which attempts to access the initialStringHeap. If this heap has been garbage collected before the function is executed, it can lead to an exploitable crash. This issue affects Firefox versions below 117 and Firefox ESR versions below 115.2, as well as Thunderbird versions below 115.2. The potential ramifications include application crashes and the possibility of exploitation by malicious actors.
How To Fix
Minimum fixed version
115.2.0esr-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade firefox-esrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched versions as soon as they are available.
Conclusion
This report outlines a critical vulnerability affecting Firefox ESR and Thunderbird, emphasizing the importance of updating to the latest versions to mitigate risks. Users are encouraged to stay informed and utilize tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for firefox-esr →
FAQ
The vulnerability is related to improper memory management in Firefox ESR and Thunderbird, which can lead to crashes and potential exploitation.
Firefox versions below 117, Firefox ESR versions below 115.2, and Thunderbird versions below 115.2 are affected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is recommended to monitor the situation and apply the updates as soon as possible.
More information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-4577.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for firefox-esr.
