CVE-2023-37211
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
Memory safety bugs are present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code.
Risk Assessment
Organizations may be at risk of attacks that exploit these vulnerabilities to execute malicious code, potentially leading to data loss or system takeover.
Recommendation
It is recommended to upgrade to Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13 to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Firefox, Firefox ESR, Thunderbird
See all- CVE-2023-4057Critical
Memory safety bugs exist in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs may lead to memory corruption, potentially allowing arbitrary code execution.
- CVE-2023-34416Critical
Memory safety bugs exist in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs may lead to memory corruption, potentially allowing arbitrary code execution.
- CVE-2026-12314High
A memory safety bug was fixed in Firefox 152. This vulnerability also affects Firefox ESR 140.12 and Thunderbird 152 and 140.12.
- CVE-2026-12312High
Memory safety bug fixed in Firefox 152. This vulnerability also affects Firefox ESR 140.12 and Thunderbird 152 and 140.12.
- CVE-2026-12310High
Memory safety bug fixed in Firefox 152. This vulnerability was also fixed in Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
- CVE-2026-12308Medium
Memory safety bug fixed in Firefox 152. This vulnerability was also fixed in Firefox ESR 140.12 and Thunderbird 152 and 140.12.
- CVE-2026-12305High
A memory safety bug was fixed in Firefox 152. This vulnerability was also fixed in Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
- CVE-2023-3600High
CVE-2023-3600 affects the worker lifecycle, where a use-after-free condition could have occurred, potentially leading to an exploitable crash. This affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird < 115.0.1.
- CVE-2023-37201High
CVE-2023-37201 allows an attacker to trigger a use-after-free condition when creating a WebRTC connection over HTTPS. This affects Firefox versions < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.
Original NVD description (English source)
Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.