CVE-2023-5174

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 118 Firefox ESR versions prior to 115.3 Thunderbird versions prior to 115.3

Description The issue is related to the use of memory after it has been freed, which can lead to a potentially exploitable crash. This occurs when Windows fails to duplicate a handle during process creation, and the sandbox code inadvertently frees a pointer twice. The bug only affects Firefox on Windows when run in non-standard configurations, such as using runas. Other operating systems are unaffected.

Recommendations For Firefox versions prior to 118, update to version 118 or later. For Firefox ESR versions prior to 115.3, update to version 115.3 or later. For Thunderbird versions prior to 115.3, update to version 115.3 or later. As a temporary workaround, consider avoiding the use of non-standard configurations, such as running Firefox with runas, until the issue is resolved.