description: If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash.
*This bug only affects Firefox on Windows when run in non-standard configurations (such as using `runas`). Other operating systems are unaffected.* This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3.
problem types: Double-free in process spawning on Windows
affected:
{
product: Firefox
vendor: Mozilla
versions:
lessThan: 118, status: affected, version: unspecified, versionType: custom
}
{
product: Firefox ESR
vendor: Mozilla
versions:
lessThan: 115.3, status: affected, version: unspecified, versionType: custom
}
{
product: Thunderbird
vendor: Mozilla
versions:
lessThan: 115.3, status: affected, version: unspecified, versionType: custom
}
