Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2023-25744: Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7

44
This month
HIGH 8.8UPGRADEUPGRADE

CVE-2023-25744 is a high-severity flaw (CVSS 8.8) affecting firefox, firefox esr. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 110 and Firefox ESR < 102.8.

Why this priority

  • High severity

A fixed release or distro patch exists.

Risk facts

CVSS score8.8 (High)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionRequired
EPSS exploit chance0.7% (top 48%)
CISA exploited listNo
WeaknessCWE-787
Published2023-06-02
Last modified2026-10-23
Publisher (CNA): Mozilla Corporation · Vendor: mozilla

Am I affected?

Timeline

mozilla firefox UPGRADE
Affected: < 110.0
Fixed in: 110.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy firefox || rpm -q firefox || firefox --version
2. UPGRADE to 110.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade firefox
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade firefox
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
mozilla firefox esr UPGRADE
Affected: < 102.8
Fixed in: 102.8
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy firefox-esr || rpm -q firefox-esr || firefox-esr --version
2. UPGRADE to 102.8 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade firefox-esr
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade firefox-esr
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Related CVEs

References

← Back to latest CVEs