Skip to content
OpenAdvisories
Unscored CVE-2023-29537 EUVD-2023-33079GHSA-cm5p-vcj3-gv4c

Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vul…

Published Jun 2, 2023 · Updated Jan 9, 2025 · Assigned by mozilla

Vendor: Mozilla Product: Firefox Product: Firefox for Android Product: Focus for Android Package: firefox Package: mozjs38 Package: mozjs52 Package: mozjs68 Package: mozjs78 Package: mozjs91 Platform: Android Category: Browsers Ecosystem: Ubuntu

Description

Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

Affected products

VendorProductAffectedFixed
Mozilla Firefox for Android unspecified – < 112 112
Mozilla Firefox unspecified – < 112 112
Mozilla Focus for Android unspecified – < 112 112

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS mozjs78 +1 No fix yet —
Ubuntu 20.04 LTS firefox 112.0+build2-0ubuntu0.20.04.1 USN-6010-1
Ubuntu 20.04 LTS mozjs52 +1 No fix yet —
Ubuntu 18.04 LTS firefox 112.0+build2-0ubuntu0.18.04.1 USN-6010-1
Ubuntu 18.04 LTS mozjs38 +1 No fix yet —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaFirefox 112.0.1-1.1 openSUSE-SU-2024:12882-1
openSUSE Tumbleweed firefox-esr 128.5.1-1.1 openSUSE-SU-2024:14572-1

Advisories 4

References