Connect with us

Hi, what are you looking for?



Firefox 118 Patches High-Severity Vulnerabilities

Firefox 118 patches six high-severity vulnerabilities, including a memory leak potentially leading to sandbox escape.

Mozilla on Tuesday announced security updates for both Firefox and Thunderbird, addressing a total of nine vulnerabilities in its products, including high-severity flaws.

Firefox 118 was released to the stable channel with patches for all nine vulnerabilities – all are  memory issues, most of which could lead to exploitable crashes.

Tracked as CVE-2023-5168 and CVE-2023-5169, the first two high-severity flaws are described as out-of-bounds write issues in the browser’s FilterNodeD2D1 and PathOps components. According to Mozilla, both could lead to “a potentially exploitable crash in a privileged process”.

The third bug, CVE-2023-5170, is a memory leak issue that “could be used to effect a sandbox escape if the correct data was leaked”, Mozilla explains in its advisory.

Another high-severity vulnerability was patched in the Ion compiler. Tracked as CVE-2023-5171 and described as a use-after-free condition, the bug allowed an attacker to write two NUL bytes, causing a potentially exploitable crash.

Firefox 118 also patches CVE-2023-5172, a memory corruption in Ion Hints that could lead to a use-after-free condition and a potentially exploitable crash.

The browser update also resolves multiple high-severity memory safety bugs that are collectively tracked as CVE-2023-5176. According to Mozilla, “with enough effort”, an attacker could exploit some of these flaws to execute arbitrary code.

The three remaining issues patched with the release of Firefox 118 are medium- and low-severity memory bugs.

Advertisement. Scroll to continue reading.

On Tuesday, Mozilla announced the release of Firefox ESR 115.3 and Thunderbird 115.3 with patches for five vulnerabilities each. These include four of the high-severity flaws and one medium-severity bug that Firefox 118 addresses.

Mozilla makes no mention of any of these vulnerabilities being exploited in malicious attacks. Additional details can be found on Mozilla’s security advisories page.

Related: High-Severity Memory Corruption Vulnerabilities Patched in Firefox, Chrome

Related: Firefox 116 Patches High-Severity Vulnerabilities

Related: Firefox 115 Patches High-Severity Use-After-Free Vulnerabilities

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.


As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.