Search for vulnerabilities
Vulnerability details: VCID-dzxk-aqy1-aaac
Vulnerability ID VCID-dzxk-aqy1-aaac
Aliases CVE-2023-5176
Summary Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Status Published
Exploitability 0.5
Weighted Severity 8.8
Risk 4.4
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-787 Out-of-bounds Write
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
System Score Found at
cvssv3 9.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-5176.json
epss 0.00232 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00232 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00232 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00232 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00232 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00232 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00232 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00232 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00232 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00232 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00232 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00232 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00257 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00257 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00257 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00285 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.00561 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.02465 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.02465 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.02465 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.02465 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.02465 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.02465 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.02465 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.02465 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.02465 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.02465 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.02465 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.02465 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.02465 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.02465 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
epss 0.05935 https://api.first.org/data/v1/epss?cve=CVE-2023-5176
cvssv3.1 9.8 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195
ssvc Track https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195
cvssv3.1 9.8 https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html
ssvc Track https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html
cvssv3.1 8.8 https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
cvssv3.1 9.8 https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
ssvc Track https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
cvssv3 9.8 https://nvd.nist.gov/vuln/detail/CVE-2023-5176
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2023-5176
cvssv3.1 9.8 https://www.debian.org/security/2023/dsa-5506
ssvc Track https://www.debian.org/security/2023/dsa-5506
cvssv3.1 9.8 https://www.debian.org/security/2023/dsa-5513
ssvc Track https://www.debian.org/security/2023/dsa-5513
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2023-41
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2023-42
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2023-43
cvssv3.1 9.8 https://www.mozilla.org/security/advisories/mfsa2023-41/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2023-41/
cvssv3.1 9.8 https://www.mozilla.org/security/advisories/mfsa2023-42/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2023-42/
cvssv3.1 9.8 https://www.mozilla.org/security/advisories/mfsa2023-43/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2023-43/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-5176.json
https://api.first.org/data/v1/epss?cve=CVE-2023-5176
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5169
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5171
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5176
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5217
https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html
https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
https://www.debian.org/security/2023/dsa-5506
https://www.debian.org/security/2023/dsa-5513
https://www.mozilla.org/security/advisories/mfsa2023-41/
https://www.mozilla.org/security/advisories/mfsa2023-42/
https://www.mozilla.org/security/advisories/mfsa2023-43/
2240896 https://bugzilla.redhat.com/show_bug.cgi?id=2240896
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
CVE-2023-5176 https://nvd.nist.gov/vuln/detail/CVE-2023-5176
GLSA-202402-25 https://security.gentoo.org/glsa/202402-25
mfsa2023-41 https://www.mozilla.org/en-US/security/advisories/mfsa2023-41
mfsa2023-42 https://www.mozilla.org/en-US/security/advisories/mfsa2023-42
mfsa2023-43 https://www.mozilla.org/en-US/security/advisories/mfsa2023-43
RHSA-2023:5426 https://access.redhat.com/errata/RHSA-2023:5426
RHSA-2023:5427 https://access.redhat.com/errata/RHSA-2023:5427
RHSA-2023:5428 https://access.redhat.com/errata/RHSA-2023:5428
RHSA-2023:5429 https://access.redhat.com/errata/RHSA-2023:5429
RHSA-2023:5430 https://access.redhat.com/errata/RHSA-2023:5430
RHSA-2023:5432 https://access.redhat.com/errata/RHSA-2023:5432
RHSA-2023:5433 https://access.redhat.com/errata/RHSA-2023:5433
RHSA-2023:5434 https://access.redhat.com/errata/RHSA-2023:5434
RHSA-2023:5435 https://access.redhat.com/errata/RHSA-2023:5435
RHSA-2023:5436 https://access.redhat.com/errata/RHSA-2023:5436
RHSA-2023:5437 https://access.redhat.com/errata/RHSA-2023:5437
RHSA-2023:5438 https://access.redhat.com/errata/RHSA-2023:5438
RHSA-2023:5439 https://access.redhat.com/errata/RHSA-2023:5439
RHSA-2023:5440 https://access.redhat.com/errata/RHSA-2023:5440
RHSA-2023:5475 https://access.redhat.com/errata/RHSA-2023:5475
RHSA-2023:5477 https://access.redhat.com/errata/RHSA-2023:5477
USN-6404-1 https://usn.ubuntu.com/6404-1/
USN-6405-1 https://usn.ubuntu.com/6405-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-5176.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-23T13:27:06Z/ Found at https://bugzilla.mozilla.org/buglist.cgi?bug_id=1836353%2C1842674%2C1843824%2C1843962%2C1848890%2C1850180%2C1850983%2C1851195
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-23T13:27:06Z/ Found at https://lists.debian.org/debian-lts-announce/2023/09/msg00034.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-23T13:27:06Z/ Found at https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-5176
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-5176
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.debian.org/security/2023/dsa-5506
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-23T13:27:06Z/ Found at https://www.debian.org/security/2023/dsa-5506
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.debian.org/security/2023/dsa-5513
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-23T13:27:06Z/ Found at https://www.debian.org/security/2023/dsa-5513
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2023-41/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-23T13:27:06Z/ Found at https://www.mozilla.org/security/advisories/mfsa2023-41/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2023-42/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-23T13:27:06Z/ Found at https://www.mozilla.org/security/advisories/mfsa2023-42/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2023-43/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-23T13:27:06Z/ Found at https://www.mozilla.org/security/advisories/mfsa2023-43/
Exploit Prediction Scoring System (EPSS)
Percentile 0.61742
EPSS Score 0.00232
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.