Bug 2236084 (CVE-2023-4584)

Summary:	CVE-2023-4584 Mozilla: Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abobrov, desktop-qa-list, erack, jhorak, nobody, stransky, tpopela
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	firefox 115.2, thunderbird 115.2	Doc Type:	---
Doc Text:	The Mozilla Foundation Security Advisory describes this flaw as: Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2234841, 2234842, 2234843, 2234844, 2234845, 2234846, 2234847, 2234848, 2234849, 2234850, 2234853, 2234854, 2234855, 2234856, 2234857, 2234858, 2234859, 2234860, 2234861, 2234862, 2234864, 2234865
Bug Blocks:	2234838

Description Dhananjay Arunesh 2023-08-30 09:47:48 UTC

Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/#CVE-2023-4584

Comment 1 errata-xmlrpc 2023-09-04 15:49:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:4950 https://access.redhat.com/errata/RHSA-2023:4950

Comment 2 errata-xmlrpc 2023-09-04 15:49:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:4947 https://access.redhat.com/errata/RHSA-2023:4947

Comment 3 errata-xmlrpc 2023-09-04 15:49:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support
  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2023:4951 https://access.redhat.com/errata/RHSA-2023:4951

Comment 4 errata-xmlrpc 2023-09-04 15:50:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support
  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2023:4946 https://access.redhat.com/errata/RHSA-2023:4946

Comment 5 errata-xmlrpc 2023-09-04 15:50:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2023:4949 https://access.redhat.com/errata/RHSA-2023:4949

Comment 6 errata-xmlrpc 2023-09-04 15:51:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2023:4948 https://access.redhat.com/errata/RHSA-2023:4948

Comment 7 errata-xmlrpc 2023-09-04 15:53:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2023:4945 https://access.redhat.com/errata/RHSA-2023:4945

Comment 8 errata-xmlrpc 2023-09-04 15:55:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4958 https://access.redhat.com/errata/RHSA-2023:4958

Comment 9 errata-xmlrpc 2023-09-04 15:55:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4955 https://access.redhat.com/errata/RHSA-2023:4955

Comment 10 errata-xmlrpc 2023-09-04 15:56:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:4959 https://access.redhat.com/errata/RHSA-2023:4959

Comment 11 errata-xmlrpc 2023-09-04 15:56:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:4953 https://access.redhat.com/errata/RHSA-2023:4953

Comment 12 errata-xmlrpc 2023-09-04 15:56:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2023:4957 https://access.redhat.com/errata/RHSA-2023:4957

Comment 13 errata-xmlrpc 2023-09-04 15:56:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2023:4956 https://access.redhat.com/errata/RHSA-2023:4956

Comment 14 errata-xmlrpc 2023-09-04 15:57:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4952 https://access.redhat.com/errata/RHSA-2023:4952

Comment 15 errata-xmlrpc 2023-09-04 15:57:58 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4954 https://access.redhat.com/errata/RHSA-2023:4954

Comment 16 errata-xmlrpc 2023-09-07 11:38:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2023:5019 https://access.redhat.com/errata/RHSA-2023:5019