Mozilla Foundation Security Advisory 2023-24
Security Vulnerabilities fixed in Thunderbird 102.13
- Announced
- July 4, 2023
- Impact
- high
- Products
- Thunderbird
- Fixed in
-
- Thunderbird 102.13
In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.
#CVE-2023-37201: Use-after-free in WebRTC certificate generation
- Reporter
- Irvan Kurniawan
- Impact
- high
Description
An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS.
References
#CVE-2023-37202: Potential use-after-free from compartment mismatch in SpiderMonkey
- Reporter
- zx
- Impact
- high
Description
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free.
References
#CVE-2023-37207: Fullscreen notification obscured
- Reporter
- Shaheen Fazim
- Impact
- moderate
Description
A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks.
References
#CVE-2023-37208: Lack of warning when opening Diagcab files
- Reporter
- P Umar Farooq
- Impact
- moderate
Description
When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code.
References
#CVE-2023-37211: Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13
- Reporter
- Andrew McCreight, Matthew Gaudet, Tom Ritter, and the Mozilla Fuzzing Team,
- Impact
- high
Description
Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.