CVE-2023-4049
Full vulnerability record from the local CVENow database.
Description
Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
Severity
MEDIUM
CVSS score
5.9
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2023-08-01 15:15:10.030000
Last modified
2026-10-23 23:10:00.157000
View original CVE JSON
{
"id": "CVE-2023-4049",
"sourceIdentifier": "[email protected]",
"published": "2023-08-01T15:15:10.030",
"lastModified": "2026-10-23T23:10:00.157",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1."
},
{
"lang": "es",
"value": "Se encontraron condiciones de carrera en el código de conteo de referencias mediante inspección de código. Estas podrían haber resultado en vulnerabilidades de uso después de liberación potencialmente explotables. Esta vulnerabilidad afecta a Firefox < 116, Firefox ESR anterior a 102.14 y Firefox ESR anterior a 115.1."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Mozilla",
"product": "Firefox",
"versions": [
{
"version": "unspecified",
"lessThan": "116",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Mozilla",
"product": "Firefox ESR",
"versions": [
{
"version": "unspecified",
"lessThan": "102.14",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Mozilla",
"product": "Firefox ESR",
"versions": [
{
"version": "unspecified",
"lessThan": "115.1",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2024-10-22T15:10:50.908793Z",
"id": "CVE-2023-4049",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-362"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
"versionEndExcluding": "116.0",
"matchCriteriaId": "C6C6420C-0883-4585-A655-4C470029CB85"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
"versionStartIncluding": "102.0",
"versionEndExcluding": "102.14",
"matchCriteriaId": "FE961FDE-D5BE-40C3-8F2D-3952F6A9FC46"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
"versionStartIncluding": "115.0",
"versionEndExcluding": "115.1",
"matchCriteriaId": "EACD3AEC-1B8F-41F1-9AFF-4FED63609109"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
"matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C"
}
]
}
]
}
],
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1842658",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Permissions Required"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html",
"source": "[email protected]"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html",
"source": "[email protected]"
},
{
"url": "https://www.debian.org/security/2023/dsa-5464",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.debian.org/security/2023/dsa-5469",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2023-29/",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2023-30/",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2023-31/",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1842658",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Permissions Required"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2023/dsa-5464",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.debian.org/security/2023/dsa-5469",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2023-29/",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2023-30/",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2023-31/",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
}
]
}