An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag…

Description

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Scores

EPSS (exploitation in 30 days)

0.82% · top 43% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

• Arbitrary memory write via PKCS 12 in NSS
• CWE-noinfo Not enough information

Affected products

• Mozilla · Firefox

  • affected unspecified – < 110

• Mozilla · Thunderbird

  • affected unspecified – < 102.8

• Mozilla · Firefox ESR

  • affected unspecified – < 102.8

References (6)

• https://www.mozilla.org/security/advisories/mfsa2023-06/ (opens in a new tab)x_transferred
• https://www.mozilla.org/security/advisories/mfsa2023-05/ (opens in a new tab)x_transferred
• https://www.mozilla.org/security/advisories/mfsa2023-07/ (opens in a new tab)x_transferred
• https://bugzilla.mozilla.org/show_bug.cgi?id=1804640 (opens in a new tab)x_transferred
• https://alas.aws.amazon.com/AL2/ALAS-2023-1992.html (opens in a new tab)x_transferred
• https://security.netapp.com/advisory/ntap-20230324-0008/ (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-0767](https://trackcve.app/badge/CVE-2023-0767.svg)](https://trackcve.app/cve/CVE-2023-0767)

Record last updated 5 May 2025, 16:07 UTC.