CVE-2023-25738
Summary
| CVE | CVE-2023-25738 |
|---|---|
| State | PUBLISHED |
| Assigner | mozilla |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-06-02 17:15:11 UTC |
| Updated | 2026-10-23 23:10:00 UTC |
| Description | Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. |
Risk And Classification
Primary CVSS: v3.1 6.5 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS: 0.006350000 probability, percentile 0.498070000 (date 2026-10-23)
Problem Types: CWE-125 | Printing on Windows could potentially crash Firefox with some device drivers | CWE-125 CWE-125 Out-of-bounds Read
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| 3.1 | ADP | DECLARED | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Microsoft | Windows | - | All | All | All |
| Application | Mozilla | Firefox | All | All | All | All |
| Application | Mozilla | Firefox Esr | All | All | All | All |
| Application | Mozilla | Thunderbird | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Mozilla | Firefox | affected unspecified 110 custom | Not specified |
| CNA | Mozilla | Thunderbird | affected unspecified 102.8 custom | Not specified |
| CNA | Mozilla | Firefox ESR | affected unspecified 102.8 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Vulnerabilities fixed in Firefox ESR 102.8 — Mozilla | af854a3a-2127-422b-91ae-364da2661108 | www.mozilla.org | Vendor Advisory |
| Access Denied | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | bugzilla.mozilla.org | Issue Tracking, Permissions Required |
| Security Vulnerabilities fixed in Firefox 110 — Mozilla | af854a3a-2127-422b-91ae-364da2661108 | www.mozilla.org | Vendor Advisory |
| Security Vulnerabilities fixed in Thunderbird 102.8 — Mozilla | af854a3a-2127-422b-91ae-364da2661108 | www.mozilla.org | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 377975 Mozilla Firefox Multiple Vulnerabilities (MFSA2023-05)
- 377976 Mozilla Firefox ESR Multiple Vulnerabilities (MFSA2023-06)
- 377993 Mozilla Thunderbird Multiple Vulnerabilities (MFSA2023-07)
- 503455 Alpine Linux Security Update for firefox-esr
- 506063 Alpine Linux Security Update for firefox-esr
- 710735 Gentoo Linux Mozilla Thunderbird Multiple Vulnerabilities (GLSA 202305-36)
- 710739 Gentoo Linux Mozilla Firefox Multiple Vulnerabilities (GLSA 202305-35)
- 753724 SUSE Enterprise Linux Security Update for MozillaFirefox (SUSE-SU-2023:0461-1)
- 753729 SUSE Enterprise Linux Security Update for MozillaFirefox (SUSE-SU-2023:0466-1)
- 753731 SUSE Enterprise Linux Security Update for MozillaFirefox (SUSE-SU-2023:0469-1)
- 754204 SUSE Enterprise Linux Security Update for MozillaFirefox (SUSE-SU-2023:0469-1)