If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. *This bug only affects Firefox on Windows when run in non-standard configurations (such as using `runas`). Other operating systems are unaffected.* This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade firefox-esrUpgrade thunderbirdUpgrade firefox | Aug 22, 2024 | Sep 27, 2023 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade mail-client/thunderbird. | Feb 21, 2024 | Sep 27, 2023 |
| Mfsa2023 41 | — | Upgrade to Mozilla Firefox version 118.0Upgrade to the latest version of Mozilla Firefox | Sep 27, 2023 | Sep 26, 2023 |
| Mfsa2023 42 | — | Upgrade to Mozilla Firefox ESR version 115.3Upgrade to the latest version of Mozilla Firefox | Sep 27, 2023 | Sep 26, 2023 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 115.3Upgrade to the latest version of Mozilla Thunderbird | Sep 27, 2023 | Sep 26, 2023 |
| Suse | — | Upgrade MozillaFirefoxUpgrade MozillaThunderbirdUpgrade mozillafirefox-branding-upstreamUpgrade MozillaThunderbird-translations-commonUpgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox-develUpgrade MozillaFirefox-translations-otherUpgrade MozillaThunderbird-translations-other | Sep 28, 2023 | Sep 27, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub