CVE-2023-25746: Memory safety bugs present in Firefox ESR 102.7

This month

HIGH 8.8UPGRADEUPGRADE

CVE-2023-25746 is a high-severity flaw (CVSS 8.8) affecting firefox esr, thunderbird. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 102.8 and Firefox ESR < 102.8.

Why this priority

High severity

A fixed release or distro patch exists.

Risk facts

CVSS score	8.8 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	0.7% (top 49%)
CISA exploited list	No
Weakness	CWE-787
Published	2023-06-02
Last modified	2026-10-23

Publisher (CNA): Mozilla Corporation · Vendor: mozilla

Am I affected?

Timeline

2023-06-02 17:15 UTCPublished CVE record published
2026-10-23 23:10 UTCUpdated Record last modified

mozilla firefox esr UPGRADE

Affected: < 102.8

Fixed in: 102.8

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy firefox-esr || rpm -q firefox-esr || firefox-esr --version

2. UPGRADE to 102.8 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade firefox-esr

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade firefox-esr

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

mozilla thunderbird UPGRADE

Affected: < 102.8

Fixed in: 102.8

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy thunderbird || rpm -q thunderbird || thunderbird --version

2. UPGRADE to 102.8 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade thunderbird

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade thunderbird

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Fedora 46 · kwin-zones · FIXED · 1.0.13-1.fc46 · FEDORA-2026-95888f332b · source

sudo dnf upgrade --advisory=FEDORA-2026-95888f332b

Fedora ELN · nginx-mod-brotli · FIXED · 1.0.0~rc-16.eln159 · FEDORA-2026-501a6a8273 · source

sudo dnf upgrade --advisory=FEDORA-2026-501a6a8273

Ubuntu 22.04 · firefox · NOT AFFECTED

Ubuntu 20.04 · thunderbird · FIXED · 1:102.8.0+build2-0ubuntu0.20.04.1

sudo apt update && sudo apt install --only-upgrade thunderbird dpkg --compare-versions "$(dpkg-query -W -f='${Version}' thunderbird)" ge "1:102.8.0+build2-0ubuntu0.20.04.1" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 22.04 · thunderbird · FIXED · 1:102.8.0+build2-0ubuntu0.22.04.1

sudo apt update && sudo apt install --only-upgrade thunderbird dpkg --compare-versions "$(dpkg-query -W -f='${Version}' thunderbird)" ge "1:102.8.0+build2-0ubuntu0.22.04.1" && echo PATCHED || echo STILL-VULNERABLE

Debian 12 · firefox-esr · FIXED · 102.8.0esr-1

sudo apt update && sudo apt install --only-upgrade firefox-esr dpkg --compare-versions "$(dpkg-query -W -f='${Version}' firefox-esr)" ge "102.8.0esr-1" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · firefox-esr · FIXED · 102.8.0esr-1

sudo apt update && sudo apt install --only-upgrade firefox-esr dpkg --compare-versions "$(dpkg-query -W -f='${Version}' firefox-esr)" ge "102.8.0esr-1" && echo PATCHED || echo STILL-VULNERABLE

Debian 12 · thunderbird · FIXED · 1:102.8.0-1

sudo apt update && sudo apt install --only-upgrade thunderbird dpkg --compare-versions "$(dpkg-query -W -f='${Version}' thunderbird)" ge "1:102.8.0-1" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · thunderbird · FIXED · 1:102.8.0-1

sudo apt update && sudo apt install --only-upgrade thunderbird dpkg --compare-versions "$(dpkg-query -W -f='${Version}' thunderbird)" ge "1:102.8.0-1" && echo PATCHED || echo STILL-VULNERABLE

RHEL 7 · firefox · FIXED · firefox-102.8.0-2.el7_9

sudo dnf upgrade --advisory=RHSA-2023:0812 rpm -q firefox

RHEL 7 · thunderbird · FIXED · thunderbird-102.8.0-2.el7_9

sudo dnf upgrade --advisory=RHSA-2023:0817 rpm -q thunderbird

RHEL 8 · firefox · FIXED · firefox-102.8.0-2.el8_7

sudo dnf upgrade --advisory=RHSA-2023:0808 rpm -q firefox

RHEL 8 · thunderbird · FIXED · thunderbird-102.8.0-2.el8_7

sudo dnf upgrade --advisory=RHSA-2023:0821 rpm -q thunderbird

RHEL 8.1 Update Services for SAP Solutions · firefox · FIXED · firefox-102.8.0-2.el8_1

sudo dnf upgrade --advisory=RHSA-2023:0806 rpm -q firefox

Alpine 3.20 · firefox-esr · FIXED · firefox-esr-102.8.0-r0

apk add --upgrade firefox-esr apk info -v firefox-esr

Alpine 3.21 · firefox-esr · FIXED · firefox-esr-102.8.0-r0

apk add --upgrade firefox-esr apk info -v firefox-esr

Alpine 3.22 · firefox-esr · FIXED · firefox-esr-102.8.0-r0

apk add --upgrade firefox-esr apk info -v firefox-esr

Alpine 3.23 · firefox-esr · FIXED · firefox-esr-102.8.0-r0

apk add --upgrade firefox-esr apk info -v firefox-esr

Amazon Linux 2 · see advisory · FIXED · ALAS2-2023-1983 · source

sudo yum update --advisory=ALAS2-2023-1983

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Related CVEs

CVE-2023-29542 CRITICAL 9.8 UPGRADE UPGRADE A newline in a filename could have been used to bypass the file extension security mechanisms that replace mal
CVE-2023-28162 HIGH 8.8 UPGRADE UPGRADE While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type
CVE-2023-32214 HIGH 7.5 UPGRADE UPGRADE Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note:
CVE-2023-25744 HIGH 8.8 UPGRADE UPGRADE Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7
CVE-2023-29536 HIGH 8.8 UPGRADE UPGRADE An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled me

References

← Back to latest CVEs