CVE-2023-1945 is a moderate-severity vulnerability affecting certain versions of Thunderbird and Firefox ESR. This issue occurs when unexpected data returned from the Safe Browsing API leads to memory corruption and a potentially exploitable crash. Systems running the mentioned versions of Thunderbird and Firefox ESR are at risk.

How do I know if I'm affected?

If you're using Mozilla Firefox ESR or Thunderbird, you might be affected by the vulnerability. This issue can cause memory corruption and a potentially exploitable crash when unexpected data is returned from the Safe Browsing API. The affected software versions include Mozilla Firefox ESR versions up to (excluding) 102.10 and Mozilla Thunderbird versions up to (excluding) 102.10. To check if you're affected, verify the version of your Firefox ESR or Thunderbird software and compare it to the mentioned versions.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to update your software to mitigate the risk. For Firefox ESR users, update to version 102.10, as mentioned in the Mozilla Security Advisory. Thunderbird users should update to version 102.10, as detailed in the Thunderbird Security Advisory. Updating to these versions will help protect your system from potential crashes and memory corruption.

Is CVE-2023-1945 in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-1945 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This vulnerability, titled "Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash," was added to the National Vulnerability Database on June 2, 2023. Although a specific due date and required action are not provided, users of affected Thunderbird and Firefox ESR versions are advised to update their software to mitigate the risk.

Weakness enumeration

The weakness enumeration for the CVE-2023-1945 vulnerability is categorized as CWE-787, which is an out-of-bounds write issue. This can lead to memory corruption and potential crashes in affected software.

For more details

CVE-2023-1945 is a moderate severity vulnerability affecting Thunderbird and Firefox ESR, with potential memory corruption and crashes due to unexpected data from the Safe Browsing API. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• Bugzilla Bug Report

• Security Vulnerabilities fixed in Firefox ESR 102.10

• Security Vulnerabilities fixed in Thunderbird 102.10