CVE-2023-4049
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Race conditions in reference counting code were found, which could lead to potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
Risk Assessment
Organizations may be exposed to attacks exploiting these vulnerabilities, potentially leading to unauthorized memory access and system takeover.
Recommendation
It is recommended to update Firefox to version 116 or newer and Firefox ESR to version 102.14 or 115.1 to mitigate the risk.
Other vulnerabilities in Firefox, Firefox ESR
See all- CVE-2023-4048High
An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
- CVE-2023-4047High
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
Original NVD description (English source)
Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS