CVE-2023-5171

During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3.

• CWE-416

• https://bugzilla.mozilla.org/show_bug.cgi?id=1851599Issue Tracking, Permissions Required
• https://lists.debian.org/debian-lts-announce/2023/09/msg00034.htmlMailing List, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/10/msg00015.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/Mailing List, Third Party Advisory
• https://www.debian.org/security/2023/dsa-5506Patch, Third Party Advisory
• https://www.debian.org/security/2023/dsa-5513Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-41/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-42/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-43/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1851599Issue Tracking, Permissions Required
• https://lists.debian.org/debian-lts-announce/2023/09/msg00034.htmlMailing List, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/10/msg00015.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/Mailing List, Third Party Advisory
• https://www.debian.org/security/2023/dsa-5506Patch, Third Party Advisory
• https://www.debian.org/security/2023/dsa-5513Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-41/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-42/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2023-43/Vendor Advisory

Published

Sep 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-51700Unofficial Mobile BankID Integration for WordPress lets user…9.8
• CVE-2023-51701fastify-reply-from is a Fastify plugin to forward the curren…7.5
• CVE-2023-51702Since version 5.2.0, when using deferrable mode with the pat…6.5
• CVE-2023-51704An issue was discovered in MediaWiki before 1.35.14, 1.36.x …6.1
• CVE-2023-51707MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxA…9.8
• CVE-2023-51708Bentley eB System Management Console applications within Ass…8.6
• CVE-2023-51710EMS SQL Manager 3.6.2 (build 55333) for Oracle allows DLL hi…4.2
• CVE-2023-51711An issue was discovered in Regify Regipay Client for Windows…7.8
• CVE-2023-51712An issue was discovered in Trusted Firmware-M through 2.0.0.…4.7
• CVE-2023-51713make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-by…7.5
• CVE-2023-51714An issue was discovered in the HTTP2 implementation in Qt be…9.8
• CVE-2023-51717Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Co…9.8