Out-of-bounds write in Mozilla Firefox and Firefox ESR - CVE-2023-0767

Vulnerability identifier: #VU72250

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-0767

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing PKCS 12 Safe Bag attributes. A remote attacker can create a specially crafted PKCS 12 cert bundle, trick the victim into loading it, trigger an out-of-bounds write and execute arbitrary code on the target system.

Mozilla Firefox
Firefox ESR
Oracle Linux
Debian Linux
Gentoo Linux
Amazon Linux AMI
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Software Development Kit 12
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
openSUSE Leap Micro
Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems)
Red Hat Enterprise Linux Server - Extended Life Cycle Support
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Anolis OS
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
CentOS
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
SUSE Enterprise Storage
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
Oracle Solaris
SUSE Linux Enterprise Server 12 SP2 BCL
SUSE Linux Enterprise Server 12 SP4 ESPOS
SUSE Linux Enterprise Server 12 SP4 LTSS
Ubuntu
Slackware Linux
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Desktop
SUSE Package Hub 15
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Basesystem
openSUSE Leap
Red Hat OpenShift Serverless
Multicluster Engine for Kubernetes
Oracle VM Server for x86
IBM Watson Assistant for IBM Cloud Pak for Data
OpenShift Logging
Red Hat Migration Toolkit for Applications
Oracle Communications Diameter Signaling Router
IBM Cloud Pak for Multicloud Management Monitoring
Session Smart Router
Red Hat OpenShift Container Platform
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libnss3 (Ubuntu package)
nss (Red Hat package)
nss
nss (Debian package)
nss-tools
nss-devel
nss-pkcs11-devel
nss-sysinit
nss-softokn
nss-softokn-devel
nss-softokn-freebl
nss-softokn-freebl-devel
nss-util-devel
nss-util
mozilla-nss-32bit
mozilla-nss-tools-debuginfo
libfreebl3-debuginfo
mozilla-nss-sysinit-32bit
mozilla-nss-sysinit-debuginfo-32bit
libfreebl3-32bit
libsoftokn3-hmac
libfreebl3-debuginfo-32bit
mozilla-nss-debuginfo
libsoftokn3-debuginfo
libsoftokn3
mozilla-nss-tools
mozilla-nss-debugsource
mozilla-nss-sysinit
mozilla-nss-certs
mozilla-nss
mozilla-nss-certs-debuginfo
libsoftokn3-32bit
mozilla-nss-devel
libfreebl3-hmac-32bit
mozilla-nss-certs-debuginfo-32bit
mozilla-nss-debuginfo-32bit
mozilla-nss-sysinit-debuginfo
libsoftokn3-debuginfo-32bit
libfreebl3-hmac
mozilla-nss-certs-32bit
libfreebl3
libsoftokn3-hmac-32bit
mozilla-nss-sysinit-32bit-debuginfo
libfreebl3-32bit-debuginfo
libsoftokn3-32bit-debuginfo
mozilla-nss-32bit-debuginfo
mozilla-nss-certs-32bit-debuginfo
redhat-release-virtualization-host (Red Hat package)
thunderbird (Ubuntu package)
mozilla-thunderbird
mozilla-firefox
firefox-esr (Debian package)
thunderbird (Debian package)
firefox (Red Hat package)
thunderbird (Red Hat package)
firefox
thunderbird
MozillaFirefox-translations-common
MozillaFirefox-devel
MozillaFirefox
MozillaFirefox-debugsource
MozillaFirefox-debuginfo
MozillaFirefox-translations-other
MozillaThunderbird-debuginfo
MozillaThunderbird-translations-other
MozillaThunderbird-debugsource
MozillaThunderbird
MozillaThunderbird-translations-common
MozillaFirefox-branding-upstream
mail-client/thunderbird
mail-client/thunderbird-bin
www-client/firefox
firefox (Ubuntu package)
Firefox for Android
Firefox Focus for Android
Mozilla Thunderbird
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
IBM Cloud Pak for Watson AIOps
XtremIO X2
EMC Cloud Tiering Appliance
Robotic Process Automation for Cloud Pak
Dell EMC VxRail Appliance
IBM QRadar Network Packet Capture
RSA Authentication Manager

Install updates from vendor's website.

Mozilla Firefox - update to 110.0
Firefox ESR - update to 102.8.0
Red Hat OpenShift Serverless - update to 1.29.0
Multicluster Engine for Kubernetes - addressed in versions 2.0.8, 2.1.6, 2.2.3
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
Red Hat OpenShift Container Platform - addressed in versions 4.9.59, 4.10.55, 4.12.9
OpenShift Logging - update to 5.5.9
Red Hat Migration Toolkit for Applications - update to 6.1.0
Firefox for Android - update to 110.0
Mozilla Thunderbird - update to 102.8.0
Firefox Focus for Android - update to 110.0.1
libnss3 (Ubuntu package) - addressed in versions Ubuntu Pro, 2:3.35-2ubuntu2.16, 2:3.49.1-1ubuntu1.9, 2:3.68.2-0ubuntu1.2, 2:3.82-1ubuntu0.1
Cloud Pak for Security (CP4S) - update to 1.10.12.0
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 7
IBM Cloud Pak for Watson AIOps - update to 3.7.1
nss (Red Hat package) - addressed in versions 3.44.0-11.el8_1, 3.44.0-13.el6_10, 3.53.1-13.el8_2, 3.67.0-8.el8_4, 3.79.0-5.el7_9, 3.79.0-11.el8_6, 3.79.0-11.el8_7, 3.79.0-17.el9_0, 3.79.0-17.el9_1
nss - addressed in versions 3.53.1-7.88, 3.88.1-1
nss (Debian package) - update to 2:3.61-1+deb11u3
nss-tools - addressed in versions 3.79.0-5, 3.79.0-11
nss - addressed in versions 3.79.0-5, 3.79.0-11
nss-devel - addressed in versions 3.79.0-5, 3.79.0-11
nss-pkcs11-devel - update to 3.79.0-5
nss-sysinit - addressed in versions 3.79.0-5, 3.79.0-11
nss-softokn - update to 3.79.0-11
nss-softokn-devel - update to 3.79.0-11
nss-softokn-freebl - update to 3.79.0-11
nss-softokn-freebl-devel - update to 3.79.0-11
nss-util-devel - update to 3.79.0-11
nss-util - update to 3.79.0-11
mozilla-nss-32bit - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
mozilla-nss-tools-debuginfo - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
libfreebl3-debuginfo - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
mozilla-nss-sysinit-32bit - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
mozilla-nss-sysinit-debuginfo-32bit - update to 3.79.4-58.94.1
libfreebl3-32bit - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
libsoftokn3-hmac - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
libfreebl3-debuginfo-32bit - update to 3.79.4-58.94.1
mozilla-nss-debuginfo - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
libsoftokn3-debuginfo - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
libsoftokn3 - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
mozilla-nss-tools - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
mozilla-nss-debugsource - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
mozilla-nss-sysinit - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
mozilla-nss-certs - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
mozilla-nss - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
mozilla-nss-certs-debuginfo - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
libsoftokn3-32bit - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
mozilla-nss-devel - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
libfreebl3-hmac-32bit - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
mozilla-nss-certs-debuginfo-32bit - update to 3.79.4-58.94.1
mozilla-nss-debuginfo-32bit - update to 3.79.4-58.94.1
mozilla-nss-sysinit-debuginfo - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
libsoftokn3-debuginfo-32bit - update to 3.79.4-58.94.1
libfreebl3-hmac - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
mozilla-nss-certs-32bit - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
libfreebl3 - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
libsoftokn3-hmac-32bit - addressed in versions 3.79.4-58.94.1, 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
mozilla-nss-sysinit-32bit-debuginfo - addressed in versions 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
libfreebl3-32bit-debuginfo - addressed in versions 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
libsoftokn3-32bit-debuginfo - addressed in versions 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
mozilla-nss-32bit-debuginfo - addressed in versions 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
mozilla-nss-certs-32bit-debuginfo - addressed in versions 3.79.4-150000.3.93.1, 3.79.4-150400.3.26.1
redhat-release-virtualization-host (Red Hat package) - update to 4.5.3-6.el8ev
Session Smart Router - addressed in versions 6.2.3-r2, 6.2.10, 6.3.7
XtremIO X2 - update to 6.4.2-13
Dell EMC VxRail Appliance - update to 7.0.411
IBM Qradar SIEM - update to 7.5.0 Update Pack 6
IBM QRadar Network Packet Capture - update to 7.5.0 Update Package 6
RSA Authentication Manager - update to 8.7 Patch 4
EMC Cloud Tiering Appliance - update to 13.2.0.2.22
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.4, 23.0.5
thunderbird (Ubuntu package) - addressed in versions 1:102.8.0+build2-0ubuntu0.18.04.1, 1:102.8.0+build2-0ubuntu0.20.04.1, 1:102.8.0+build2-0ubuntu0.22.04.1, 1:102.8.0+build2-0ubuntu0.22.10.1
mozilla-thunderbird - update to 102.8.0
mozilla-firefox - addressed in versions 102.8.0esr, 110.0
firefox-esr (Debian package) - update to 102.8.0esr-1~deb11u1
thunderbird (Debian package) - update to 1:102.8.0-1~deb11u1
firefox (Red Hat package) - addressed in versions 102.8.0-2.el7_9, 102.8.0-2.el8_1, 102.8.0-2.el8_2, 102.8.0-2.el8_4, 102.8.0-2.el8_6, 102.8.0-2.el8_7, 102.8.0-2.el9_0, 102.8.0-2.el9_1, 102.9.0-4.el8_1
thunderbird (Red Hat package) - addressed in versions 102.8.0-2.el7_9, 102.8.0-2.el8_1, 102.8.0-2.el8_2, 102.8.0-2.el8_4, 102.8.0-2.el8_6, 102.8.0-2.el8_7, 102.8.0-2.el9_0, 102.8.0-2.el9_1
firefox - update to 102.8.0-2.0.1
thunderbird - update to 102.8.0-2.0.1
MozillaFirefox-translations-common - addressed in versions 102.8.0-112.150.1, 102.8.0-150000.150.76.1, 102.8.0-150200.152.78.1
MozillaFirefox-devel - addressed in versions 102.8.0-112.150.1, 102.8.0-150000.150.76.1, 102.8.0-150200.152.78.1
MozillaFirefox - addressed in versions 102.8.0-112.150.1, 102.8.0-150000.150.76.1, 102.8.0-150200.152.78.1
MozillaFirefox-debugsource - addressed in versions 102.8.0-112.150.1, 102.8.0-150000.150.76.1, 102.8.0-150200.152.78.1
MozillaFirefox-debuginfo - addressed in versions 102.8.0-112.150.1, 102.8.0-150000.150.76.1, 102.8.0-150200.152.78.1
MozillaFirefox-translations-other - addressed in versions 102.8.0-150000.150.76.1, 102.8.0-150200.152.78.1
MozillaThunderbird-debuginfo - update to 102.8.0-150200.8.105.2
MozillaThunderbird-translations-other - update to 102.8.0-150200.8.105.2
MozillaThunderbird-debugsource - update to 102.8.0-150200.8.105.2
MozillaThunderbird - update to 102.8.0-150200.8.105.2
MozillaThunderbird-translations-common - update to 102.8.0-150200.8.105.2
MozillaFirefox-branding-upstream - update to 102.8.0-150200.152.78.1
mail-client/thunderbird - update to 102.10.0
mail-client/thunderbird-bin - update to 102.10.0
www-client/firefox - update to 104
firefox (Ubuntu package) - addressed in versions 110.0+build3-0ubuntu0.18.04.1, 110.0+build3-0ubuntu0.20.04.1, 110.0.1+build2-0ubuntu0.18.04.1, 110.0.1+build2-0ubuntu0.20.04.1

• https://www.mozilla.org/en-US/security/advisories/mfsa2023-05/
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-06/

• Multiple vulnerabilities in Mozilla Firefox and Firefox ESR
• Multiple vulnerabilities in Firefox for Android
• Multiple vulnerabilities in Firefox Focus for Android
• Slackware Linux update for mozilla-firefox
• SUSE update for mozilla-nss
• Multiple vulnerabilities in Mozilla Thunderbird
• Debian update for firefox-esr
• Slackware Linux update for mozilla-thunderbird
• SUSE update for mozilla-nss
• Debian update for nss
• Debian update for thunderbird
• Ubuntu update for firefox
• Red Hat Enterprise Linux 7 update for firefox
• Red Hat Enterprise Linux 8 update for firefox
• Red Hat Enterprise Linux 9 update for firefox
• Red Hat Enterprise Linux 9.0 Extended Update Support update for firefox
• Red Hat Enterprise Linux 8 update for firefox
• Red Hat Enterprise Linux 8.6 Extended Update Support update for firefox
• Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions update for firefox
• Red Hat Enterprise Linux 8.4 Extended Update Support update for firefox
• SUSE update for MozillaFirefox
• Red Hat Enterprise Linux 9 update for thunderbird
• Red Hat Enterprise Linux 9.0 Extended Update Support update for thunderbird
• Red Hat Enterprise Linux 8.6 Extended Update Support update for thunderbird
• Red Hat Enterprise Linux 8 update for thunderbird
• Red Hat Enterprise Linux 8.4 Extended Update Support update for thunderbird
• Red Hat Enterprise Linux 8 update for thunderbird
• Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions update for thunderbird
• Red Hat Enterprise Linux 7 update for thunderbird
• SUSE update for MozillaFirefox
• SUSE update for mozilla-nss
• SUSE update for MozillaFirefox
• CentOS 7 update for firefox
• CentOS 7 update for thunderbird
• Ubuntu update for nss
• Ubuntu update for firefox
• SUSE update for MozillaThunderbird
• Ubuntu update for nss
• Ubuntu update for thunderbird
• Red Hat Enterprise Linux 8 update for nss
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Red Hat Enterprise Linux 7 update for nss
• Red Hat Enterprise Linux 9.0 Extended Update Support update for nss
• Red Hat Enterprise Linux 8.4 Extended Update Support update for nss
• Red Hat Enterprise Linux 8.6 Extended Update Support update for nss
• Red Hat Enterprise Linux 9 update for nss
• Red Hat Enterprise Linux 6 Extended Lifecycle Support update for nss
• Red Hat Enterprise Linux 8 update for nss
• CentOS 7 update for nss
• Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions update for nss
• Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions update for firefox
• Multiple vulnerabilities in OpenShift Container Platform 4.10
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Logging 5.5
• Multiple vulnerabilities in OpenShift Container Platform 4.9
• Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 update for redhat-release-virtualization-host and redhat-virtualization-host
• Multiple vulnerabilities in Oracle Solaris third-party software
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.2
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.1
• Amazon Linux AMI update for nss
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.0
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Multiple vulnerabilities in Oracle VM Server for x86
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Gentoo update for Mozilla Thunderbird
• Gentoo update for Mozilla Firefox
• Multiple vulnerabilities in OpenShift Serverless
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM QRadar SIEM
• Out-of-bounds write in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in Oracle Communications Diameter Signaling Router
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Monitoring
• Multiple vulnerabilities in IBM QRadar Network Packet Capture
• Multiple vulnerabilities in Juniper Networks Session Smart Router
• Amazon Linux AMI update for nss
• Multiple vulnerabilities in Dell XtremIO X2
• Anolis OS update for firefox
• Anolis OS update for thunderbird
• Anolis OS update for firefox
• Anolis OS update for thunderbird
• Anolis OS update for nss
• Anolis OS update for nss
• RSA Authentication Manager update for third-party components
• Juniper Session Smart Router update for third-party components