Red Hat Security Advisory: firefox security update

Fixed packages 4

Vulnerabilities 9

• High 8.8
  CVE-2023-29541

  Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run att…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-29550

  Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruptio…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Medium 6.5
  CVE-2023-1945

  Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable c…

  Mozilla Thunderbird Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Medium 6.5
  CVE-2023-29548

  A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affe…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Medium 5.3
  CVE-2023-1999 Public exploit

  Use after free in libwebp

  There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encode…

  Chromium libwebp thunderbird mozjs38 Debian Ubuntu Azure Linux Alpine
  Jun 20, 2023
• Unscored —
  CVE-2023-29533

  A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscree…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Unscored —
  CVE-2023-29535

  Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resu…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Unscored —
  CVE-2023-29536

  An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, res…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Unscored —
  CVE-2023-29539

  When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Jun 2, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2186101
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2186102
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2186103
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2186104
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2186105
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2186106
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2186109
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2186110
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2186111
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1786.json
• report
  https://access.redhat.com/security/cve/CVE-2023-1945
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-1945
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-1945
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945
• report
  https://access.redhat.com/security/cve/CVE-2023-1999
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-1999
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-1999
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/#CVE-2023-1999
• report
  https://access.redhat.com/security/cve/CVE-2023-29533
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-29533
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-29533
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533
• report
  https://access.redhat.com/security/cve/CVE-2023-29535
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-29535
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-29535
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535
• report
  https://access.redhat.com/security/cve/CVE-2023-29536
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-29536
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-29536
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536
• report
  https://access.redhat.com/security/cve/CVE-2023-29539
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-29539
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-29539
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539
• report
  https://access.redhat.com/security/cve/CVE-2023-29541
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-29541
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-29541