Red Hat Security Advisory: firefox security update

Fixed packages 4

Vulnerabilities 5

• High 8.8
  CVE-2023-5217 Exploited Public exploit EPSS 49%

  Electron affected by libvpx's heap buffer overflow in vp8 encoding

  Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  Google Chrome libvpx chromium Browsers Debian Ubuntu Alpine npm
  Sep 28, 2023

  KEV Oct 2, 2023
• Critical 9.8
  CVE-2023-5176

  Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Sep 27, 2023
• Unscored —
  CVE-2023-3600

  Use-after-free in workers

  During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash. This vulnerability affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird < 115.0.1.

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Jul 12, 2023
• Unscored —
  CVE-2023-5169

  A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds wri…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Sep 27, 2023
• Unscored —
  CVE-2023-5171

  During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Sep 27, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2222652
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2240893
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2240894
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2240896
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2241191
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5434.json
• report
  https://access.redhat.com/security/cve/CVE-2023-3600
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-3600
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-3600
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-26/#CVE-2023-3600
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-27/#CVE-2023-3600
• report
  https://access.redhat.com/security/cve/CVE-2023-5169
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5169
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5169
• report
  https://access.redhat.com/security/cve/CVE-2023-5171
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5171
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5171
• report
  https://access.redhat.com/security/cve/CVE-2023-5176
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5176
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5176
• report
  https://access.redhat.com/security/cve/CVE-2023-5217
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5217
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5217
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog