CVE-2023-4046

Description

In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

Reserved 2023-08-01 | Published 2023-08-01 | Updated 2024-10-22 | Assigner mozilla

Problem types

Incorrect value used during WASM compilation

Product status

Any version before 116
affected

Any version before 102.14
affected

Any version before 115.1
affected

Credits

Alexander Guryanov

References

bugzilla.mozilla.org/show_bug.cgi?id=1837686

www.mozilla.org/security/advisories/mfsa2023-29/

www.mozilla.org/security/advisories/mfsa2023-30/

www.mozilla.org/security/advisories/mfsa2023-31/

www.debian.org/security/2023/dsa-5464

www.debian.org/security/2023/dsa-5469

lists.debian.org/debian-lts-announce/2023/08/msg00008.html

lists.debian.org/debian-lts-announce/2023/08/msg00010.html

cve.org (CVE-2023-4046)

nvd.nist.gov (CVE-2023-4046)

Download JSON