CVE-2023-0767

Mozilla Firefox and 4 others: An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory…

CVE-2023-0767 is fixed in 37 products on 2 platforms, first by firefox 110.0+build3-0ubuntu0.18.04.1, released February 14, 2023. It is not reported as exploited. Patch Radar priority: High.

HighFixed on 2 platforms
CVSS
8.8
Important
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0082
57th percentile

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Where it's fixed

ProductFixed inFixReleased
Windows apps
Mozilla Firefox (en-US) 110.0 Mozilla Firefox (en-US) 110.0 Feb 16, 2023
Mozilla Firefox ESR (en-US) 115.4.0 Mozilla Firefox ESR (en-US) 115.4.0 Oct 17, 2023
Mozilla Thunderbird (en-US) 115.8.0 Mozilla Thunderbird (en-US) 115.8.0 Feb 21, 2024
Linux
firefox · Ubuntu 18.04.6 LTS (bionic) 110.0+build3-0ubuntu0.18.04.1 firefox 110.0+build3-0ubuntu0.18.04.1 Feb 14, 2023
firefox · Ubuntu 20.04 LTS (focal) 110.0+build3-0ubuntu0.20.04.1 firefox 110.0+build3-0ubuntu0.20.04.1 Feb 14, 2023
firefox · almalinux 8 102.8.0-2.el8_7.alma ALSA-2023:0808 Feb 20, 2023
firefox · almalinux 9 102.8.0-2.el9_1.alma ALSA-2023:0810 Feb 20, 2023
firefox · ol 8 0:102.8.0-2.0.1.el8_7 ELSA-2023-0808 Feb 20, 2023
firefox · ol 9 0:102.8.0-2.0.1.el9_1 ELSA-2023-0810 Feb 20, 2023
firefox · rocky 8 0:102.8.0-2.el8_7 RLSA-2023:0808 Feb 22, 2023
firefox · rocky 9 0:102.8.0-2.el9_1 RLSA-2023:0810 Feb 22, 2023
firefox-esr · Debian 11.6 (bullseye) 102.8.0esr-1~deb11u1 DSA-5350-1 Feb 15, 2023
firefox-esr · Debian 12.15 (bookworm) 102.8.0esr-1 DEBIAN-CVE-2023-0767 Jun 2, 2023
firefox-esr · Debian 13.5 (trixie) 102.8.0esr-1 DEBIAN-CVE-2023-0767 Jun 2, 2023
firefox-esr · Debian 14 102.8.0esr-1 DEBIAN-CVE-2023-0767 Jun 2, 2023
firefox-geckodriver · Ubuntu 18.04.6 LTS (bionic) 110.0+build3-0ubuntu0.18.04.1 firefox-geckodriver 110.0+build3-0ubuntu0.18.04.1 Feb 14, 2023
firefox-geckodriver · Ubuntu 20.04 LTS (focal) 110.0+build3-0ubuntu0.20.04.1 firefox-geckodriver 110.0+build3-0ubuntu0.20.04.1 Feb 14, 2023
firefox-mozsymbols · Ubuntu 18.04.6 LTS (bionic) 110.0+build3-0ubuntu0.18.04.1 firefox-mozsymbols 110.0+build3-0ubuntu0.18.04.1 Feb 14, 2023
firefox-mozsymbols · Ubuntu 20.04 LTS (focal) 110.0+build3-0ubuntu0.20.04.1 firefox-mozsymbols 110.0+build3-0ubuntu0.20.04.1 Feb 14, 2023
firefox-x11 · almalinux 9 102.8.0-2.el9_1.alma ALSA-2023:0810 Feb 20, 2023
firefox-x11 · ol 9 0:102.8.0-2.0.1.el9_1 ELSA-2023-0810 Feb 20, 2023
libnss3 · Ubuntu 18.04.6 LTS (bionic) 2:3.35-2ubuntu2.16 libnss3 2:3.35-2ubuntu2.16 Feb 14, 2023
libnss3 · Ubuntu 20.04 LTS (focal) 2:3.49.1-1ubuntu1.9 libnss3 2:3.49.1-1ubuntu1.9 Feb 14, 2023
libnss3 · Ubuntu 22.04.1 LTS (jammy) 2:3.68.2-0ubuntu1.2 libnss3 2:3.68.2-0ubuntu1.2 Feb 14, 2023
libnss3-tools · Ubuntu 18.04.6 LTS (bionic) 2:3.35-2ubuntu2.16 libnss3-tools 2:3.35-2ubuntu2.16 Feb 14, 2023
libnss3-tools · Ubuntu 20.04 LTS (focal) 2:3.49.1-1ubuntu1.9 libnss3-tools 2:3.49.1-1ubuntu1.9 Feb 14, 2023
libnss3-tools · Ubuntu 22.04.1 LTS (jammy) 2:3.68.2-0ubuntu1.2 libnss3-tools 2:3.68.2-0ubuntu1.2 Feb 14, 2023
nspr · RHEL 9 0:4.34.0-17.el9_1 RHSA-2023:1368 Mar 21, 2023
nspr · almalinux 9 4.34.0-17.el9_1 ALSA-2023:1368 Mar 21, 2023
nspr · amzn 2023 4.35.0-4.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nspr · ol 9 0:4.34.0-17.el9_1 ELSA-2023-1368 Mar 21, 2023
nspr-debuginfo · amzn 2023 4.35.0-4.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nspr-devel · RHEL 9 0:4.34.0-17.el9_1 RHSA-2023:1368 Mar 21, 2023
nspr-devel · almalinux 9 4.34.0-17.el9_1 ALSA-2023:1368 Mar 21, 2023
nspr-devel · amzn 2023 4.35.0-4.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nspr-devel · ol 9 0:4.34.0-17.el9_1 ELSA-2023-1368 Mar 21, 2023
nss · Debian 11.6 (bullseye) 2:3.61-1+deb11u3 DSA-5353-1 Feb 17, 2023
nss · Debian 12.15 (bookworm) 2:3.87.1-1 DEBIAN-CVE-2023-0767 Jun 2, 2023
nss · Debian 13.5 (trixie) 2:3.87.1-1 DEBIAN-CVE-2023-0767 Jun 2, 2023
nss · Debian 14 2:3.87.1-1 DEBIAN-CVE-2023-0767 Jun 2, 2023
nss · RHEL 8 0:3.79.0-11.el8_7 RHSA-2023:1252 Mar 15, 2023
nss · RHEL 9 0:3.79.0-17.el9_1 RHSA-2023:1368 Mar 21, 2023
nss · almalinux 8 3.79.0-11.el8_7 ALSA-2023:1252 Mar 15, 2023
nss · almalinux 9 3.79.0-17.el9_1 ALSA-2023:1368 Mar 21, 2023
nss · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss · ol 8 0:3.79.0-11.el8_7 ELSA-2023-1252 Mar 15, 2023
nss · ol 9 0:3.79.0-17.el9_1 ELSA-2023-1368 Mar 21, 2023
nss · rocky 8 0:3.79.0-11.el8_7 RLSA-2023:1252 Mar 16, 2023
nss · rocky 9 0:3.79.0-17.el9_1 RLSA-2023:1368 Mar 28, 2023
nss-debuginfo · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-debugsource · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-devel · RHEL 8 0:3.79.0-11.el8_7 RHSA-2023:1252 Mar 15, 2023
nss-devel · RHEL 9 0:3.79.0-17.el9_1 RHSA-2023:1368 Mar 21, 2023
nss-devel · almalinux 8 3.79.0-11.el8_7 ALSA-2023:1252 Mar 15, 2023
nss-devel · almalinux 9 3.79.0-17.el9_1 ALSA-2023:1368 Mar 21, 2023
nss-devel · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-devel · ol 8 0:3.79.0-11.el8_7 ELSA-2023-1252 Mar 15, 2023
nss-devel · ol 9 0:3.79.0-17.el9_1 ELSA-2023-1368 Mar 21, 2023
nss-pkcs11-devel · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-softokn · RHEL 8 0:3.79.0-11.el8_7 RHSA-2023:1252 Mar 15, 2023
nss-softokn · RHEL 9 0:3.79.0-17.el9_1 RHSA-2023:1368 Mar 21, 2023
nss-softokn · almalinux 8 3.79.0-11.el8_7 ALSA-2023:1252 Mar 15, 2023
nss-softokn · almalinux 9 3.79.0-17.el9_1 ALSA-2023:1368 Mar 21, 2023
nss-softokn · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-softokn · ol 8 0:3.79.0-11.el8_7 ELSA-2023-1252 Mar 15, 2023
nss-softokn · ol 9 0:3.79.0-17.el9_1 ELSA-2023-1368 Mar 21, 2023
nss-softokn-debuginfo · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-softokn-devel · RHEL 8 0:3.79.0-11.el8_7 RHSA-2023:1252 Mar 15, 2023
nss-softokn-devel · RHEL 9 0:3.79.0-17.el9_1 RHSA-2023:1368 Mar 21, 2023
nss-softokn-devel · almalinux 8 3.79.0-11.el8_7 ALSA-2023:1252 Mar 15, 2023
nss-softokn-devel · almalinux 9 3.79.0-17.el9_1 ALSA-2023:1368 Mar 21, 2023
nss-softokn-devel · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-softokn-devel · ol 8 0:3.79.0-11.el8_7 ELSA-2023-1252 Mar 15, 2023
nss-softokn-devel · ol 9 0:3.79.0-17.el9_1 ELSA-2023-1368 Mar 21, 2023
nss-softokn-freebl · RHEL 8 0:3.79.0-11.el8_7 RHSA-2023:1252 Mar 15, 2023
nss-softokn-freebl · RHEL 9 0:3.79.0-17.el9_1 RHSA-2023:1368 Mar 21, 2023
nss-softokn-freebl · almalinux 8 3.79.0-11.el8_7 ALSA-2023:1252 Mar 15, 2023
nss-softokn-freebl · almalinux 9 3.79.0-17.el9_1 ALSA-2023:1368 Mar 21, 2023
nss-softokn-freebl · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-softokn-freebl · ol 8 0:3.79.0-11.el8_7 ELSA-2023-1252 Mar 15, 2023
nss-softokn-freebl · ol 9 0:3.79.0-17.el9_1 ELSA-2023-1368 Mar 21, 2023
nss-softokn-freebl-debuginfo · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-softokn-freebl-devel · RHEL 8 0:3.79.0-11.el8_7 RHSA-2023:1252 Mar 15, 2023
nss-softokn-freebl-devel · RHEL 9 0:3.79.0-17.el9_1 RHSA-2023:1368 Mar 21, 2023
nss-softokn-freebl-devel · almalinux 8 3.79.0-11.el8_7 ALSA-2023:1252 Mar 15, 2023
nss-softokn-freebl-devel · almalinux 9 3.79.0-17.el9_1 ALSA-2023:1368 Mar 21, 2023
nss-softokn-freebl-devel · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-softokn-freebl-devel · ol 8 0:3.79.0-11.el8_7 ELSA-2023-1252 Mar 15, 2023
nss-softokn-freebl-devel · ol 9 0:3.79.0-17.el9_1 ELSA-2023-1368 Mar 21, 2023
nss-sysinit · RHEL 8 0:3.79.0-11.el8_7 RHSA-2023:1252 Mar 15, 2023
nss-sysinit · RHEL 9 0:3.79.0-17.el9_1 RHSA-2023:1368 Mar 21, 2023
nss-sysinit · almalinux 8 3.79.0-11.el8_7 ALSA-2023:1252 Mar 15, 2023
nss-sysinit · almalinux 9 3.79.0-17.el9_1 ALSA-2023:1368 Mar 21, 2023
nss-sysinit · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-sysinit · ol 8 0:3.79.0-11.el8_7 ELSA-2023-1252 Mar 15, 2023
nss-sysinit · ol 9 0:3.79.0-17.el9_1 ELSA-2023-1368 Mar 21, 2023
nss-sysinit-debuginfo · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-tools · RHEL 8 0:3.79.0-11.el8_7 RHSA-2023:1252 Mar 15, 2023
nss-tools · RHEL 9 0:3.79.0-17.el9_1 RHSA-2023:1368 Mar 21, 2023
nss-tools · almalinux 8 3.79.0-11.el8_7 ALSA-2023:1252 Mar 15, 2023
nss-tools · almalinux 9 3.79.0-17.el9_1 ALSA-2023:1368 Mar 21, 2023
nss-tools · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-tools · ol 8 0:3.79.0-11.el8_7 ELSA-2023-1252 Mar 15, 2023
nss-tools · ol 9 0:3.79.0-17.el9_1 ELSA-2023-1368 Mar 21, 2023
nss-tools-debuginfo · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-util · RHEL 8 0:3.79.0-11.el8_7 RHSA-2023:1252 Mar 15, 2023
nss-util · RHEL 9 0:3.79.0-17.el9_1 RHSA-2023:1368 Mar 21, 2023
nss-util · almalinux 8 3.79.0-11.el8_7 ALSA-2023:1252 Mar 15, 2023
nss-util · almalinux 9 3.79.0-17.el9_1 ALSA-2023:1368 Mar 21, 2023
nss-util · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-util · ol 8 0:3.79.0-11.el8_7 ELSA-2023-1252 Mar 15, 2023
nss-util · ol 9 0:3.79.0-17.el9_1 ELSA-2023-1368 Mar 21, 2023
nss-util-debuginfo · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-util-devel · RHEL 8 0:3.79.0-11.el8_7 RHSA-2023:1252 Mar 15, 2023
nss-util-devel · RHEL 9 0:3.79.0-17.el9_1 RHSA-2023:1368 Mar 21, 2023
nss-util-devel · almalinux 8 3.79.0-11.el8_7 ALSA-2023:1252 Mar 15, 2023
nss-util-devel · almalinux 9 3.79.0-17.el9_1 ALSA-2023:1368 Mar 21, 2023
nss-util-devel · amzn 2023 3.88.1-1.amzn2023.0.1 ALAS2023-2023-124 Mar 6, 2023
nss-util-devel · ol 8 0:3.79.0-11.el8_7 ELSA-2023-1252 Mar 15, 2023
nss-util-devel · ol 9 0:3.79.0-17.el9_1 ELSA-2023-1368 Mar 21, 2023
thunderbird · Debian 12.15 (bookworm) 1:102.8.0-1 DEBIAN-CVE-2023-0767 Jun 2, 2023
thunderbird · Debian 13.5 (trixie) 1:102.8.0-1 DEBIAN-CVE-2023-0767 Jun 2, 2023
thunderbird · Debian 14 1:102.8.0-1 DEBIAN-CVE-2023-0767 Jun 2, 2023
thunderbird · Ubuntu 18.04.6 LTS (bionic) 1:102.8.0+build2-0ubuntu0.18.04.1 thunderbird 1:102.8.0+build2-0ubuntu0.18.04.1 Feb 19, 2023
thunderbird · Ubuntu 20.04 LTS (focal) 1:102.8.0+build2-0ubuntu0.20.04.1 thunderbird 1:102.8.0+build2-0ubuntu0.20.04.1 Feb 19, 2023
thunderbird · Ubuntu 22.04.1 LTS (jammy) 1:102.8.0+build2-0ubuntu0.22.04.1 thunderbird 1:102.8.0+build2-0ubuntu0.22.04.1 Feb 19, 2023
thunderbird · almalinux 8 102.8.0-2.el8_7.alma ALSA-2023:0821 Feb 20, 2023
thunderbird · almalinux 9 102.8.0-2.el9_1.alma ALSA-2023:0824 Feb 20, 2023
thunderbird · ol 8 0:102.8.0-2.0.1.el8_7 ELSA-2023-0821 Feb 20, 2023
thunderbird · ol 9 0:102.8.0-2.0.1.el9_1 ELSA-2023-0824 Feb 20, 2023
thunderbird · rocky 8 0:102.8.0-2.el8_7 RLSA-2023:0821 Feb 22, 2023
thunderbird · rocky 9 0:102.8.0-2.el9_1 RLSA-2023:0824 Feb 22, 2023
thunderbird-gnome-support · Ubuntu 18.04.6 LTS (bionic) 1:102.8.0+build2-0ubuntu0.18.04.1 thunderbird-gnome-support 1:102.8.0+build2-0ubuntu0.18.04.1 Feb 19, 2023
thunderbird-gnome-support · Ubuntu 20.04 LTS (focal) 1:102.8.0+build2-0ubuntu0.20.04.1 thunderbird-gnome-support 1:102.8.0+build2-0ubuntu0.20.04.1 Feb 19, 2023
thunderbird-gnome-support · Ubuntu 22.04.1 LTS (jammy) 1:102.8.0+build2-0ubuntu0.22.04.1 thunderbird-gnome-support 1:102.8.0+build2-0ubuntu0.22.04.1 Feb 19, 2023
thunderbird-mozsymbols · Ubuntu 18.04.6 LTS (bionic) 1:102.8.0+build2-0ubuntu0.18.04.1 thunderbird-mozsymbols 1:102.8.0+build2-0ubuntu0.18.04.1 Feb 19, 2023
thunderbird-mozsymbols · Ubuntu 20.04 LTS (focal) 1:102.8.0+build2-0ubuntu0.20.04.1 thunderbird-mozsymbols 1:102.8.0+build2-0ubuntu0.20.04.1 Feb 19, 2023
thunderbird-mozsymbols · Ubuntu 22.04.1 LTS (jammy) 1:102.8.0+build2-0ubuntu0.22.04.1 thunderbird-mozsymbols 1:102.8.0+build2-0ubuntu0.22.04.1 Feb 19, 2023
xul-ext-calendar-timezones · Ubuntu 18.04.6 LTS (bionic) 1:102.8.0+build2-0ubuntu0.18.04.1 xul-ext-calendar-timezones 1:102.8.0+build2-0ubuntu0.18.04.1 Feb 19, 2023
xul-ext-calendar-timezones · Ubuntu 20.04 LTS (focal) 1:102.8.0+build2-0ubuntu0.20.04.1 xul-ext-calendar-timezones 1:102.8.0+build2-0ubuntu0.20.04.1 Feb 19, 2023
xul-ext-calendar-timezones · Ubuntu 22.04.1 LTS (jammy) 1:102.8.0+build2-0ubuntu0.22.04.1 xul-ext-calendar-timezones 1:102.8.0+build2-0ubuntu0.22.04.1 Feb 19, 2023
xul-ext-gdata-provider · Ubuntu 18.04.6 LTS (bionic) 1:102.8.0+build2-0ubuntu0.18.04.1 xul-ext-gdata-provider 1:102.8.0+build2-0ubuntu0.18.04.1 Feb 19, 2023
xul-ext-gdata-provider · Ubuntu 20.04 LTS (focal) 1:102.8.0+build2-0ubuntu0.20.04.1 xul-ext-gdata-provider 1:102.8.0+build2-0ubuntu0.20.04.1 Feb 19, 2023
xul-ext-gdata-provider · Ubuntu 22.04.1 LTS (jammy) 1:102.8.0+build2-0ubuntu0.22.04.1 xul-ext-gdata-provider 1:102.8.0+build2-0ubuntu0.22.04.1 Feb 19, 2023
xul-ext-lightning · Ubuntu 18.04.6 LTS (bionic) 1:102.8.0+build2-0ubuntu0.18.04.1 xul-ext-lightning 1:102.8.0+build2-0ubuntu0.18.04.1 Feb 19, 2023
xul-ext-lightning · Ubuntu 20.04 LTS (focal) 1:102.8.0+build2-0ubuntu0.20.04.1 xul-ext-lightning 1:102.8.0+build2-0ubuntu0.20.04.1 Feb 19, 2023
xul-ext-lightning · Ubuntu 22.04.1 LTS (jammy) 1:102.8.0+build2-0ubuntu0.22.04.1 xul-ext-lightning 1:102.8.0+build2-0ubuntu0.22.04.1 Feb 19, 2023

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.