PT-2023-2010 · Mozilla · Firefox For Android

Chris Peterson · Publicado 2023-02-28 · Atualizado 2024-12-11 · CVE-2023-25747

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 110.1.0

Description The issue is related to a use-after-free vulnerability in the libaudio library of Mozilla Firefox for Android. This vulnerability can be exploited by a remote attacker using a specially crafted web page, potentially allowing the execution of arbitrary code. The vulnerability is caused by the use of memory after it has been freed.

Recommendations For Firefox for Android versions prior to 110.1.0, update to version 110.1.0 or later to resolve the issue. As a temporary workaround, consider disabling the AAudio backend when running on Android API below version 30 to minimize the risk of exploitation.

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

BDU:2023-01634

CVE-2023-25747

Produtos afetados

Firefox For Android

Referências · 8

• https://mozilla.org/en-US/security/advisories/mfsa2023-08/#CVE-2023-25747 · Aviso do Fabricante
• https://t.me/cibsecurity/65336 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25747 · Aviso do Fabricante
• https://cybersecurity-help.cz/vdb/SB2023022856 · Nota
• https://mozilla.org/security/advisories/mfsa2023-08 · Aviso do Fabricante
• https://bugzilla.mozilla.org/show_bug.cgi?id=1815801 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25747 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-01634 · Nota de Segurança