PT-2023-2010 · Mozilla · Firefox For Android

Chris Peterson · Published 2023-02-28 · Updated 2024-12-11 · CVE-2023-25747

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 110.1.0

Description The issue is related to a use-after-free vulnerability in the libaudio library of Mozilla Firefox for Android. This vulnerability can be exploited by a remote attacker using a specially crafted web page, potentially allowing the execution of arbitrary code. The vulnerability is caused by the use of memory after it has been freed.

Recommendations For Firefox for Android versions prior to 110.1.0, update to version 110.1.0 or later to resolve the issue. As a temporary workaround, consider disabling the AAudio backend when running on Android API below version 30 to minimize the risk of exploitation.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2023-01634

CVE-2023-25747

Affected Products

Firefox For Android

References · 8

• https://mozilla.org/en-US/security/advisories/mfsa2023-08/#CVE-2023-25747 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25747 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2023-08 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25747 · Security Note
• https://bdu.fstec.ru/vul/2023-01634 · Security Note
• https://t.me/cibsecurity/65336 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023022856 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=1815801 · Note