Red Hat Security Advisory: firefox security update

Fixed packages 6

Vulnerabilities 11

• High 8.8
  CVE-2023-6858

  Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling. This vulnerabil…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6856 EPSS 21%

  The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa V…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6857

  When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6859

  A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability affects Firefox …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6860

  The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be abused to esca…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6861

  The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This v…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6862

  A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. Thi…

  Mozilla Thunderbird Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6863

  The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that l…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6864

  Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6865

  `EncryptingOutputStream` was susceptible to exposing uninitialized data. This issue could only be abused in order to wr…

  Mozilla Firefox Firefox ESR mozjs38 Browsers Debian Ubuntu Alpine
  Dec 19, 2023
• Unscored —
  CVE-2023-6867

  The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking de…

  Mozilla Firefox Firefox ESR mozjs38 Browsers Debian Ubuntu Alpine
  Dec 19, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255360
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255361
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255362
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255363
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255364
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255365
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255366
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255367
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255368
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255369
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255370
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0026.json
• report
  https://access.redhat.com/security/cve/CVE-2023-6856
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6856
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6856
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-54/#CVE-2023-6856
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-55/#CVE-2023-6856
• report
  https://access.redhat.com/security/cve/CVE-2023-6857
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6857
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6857
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-54/#CVE-2023-6857
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-55/#CVE-2023-6857
• report
  https://access.redhat.com/security/cve/CVE-2023-6858
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6858
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6858
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-54/#CVE-2023-6858
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-55/#CVE-2023-6858
• report
  https://access.redhat.com/security/cve/CVE-2023-6859
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6859
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6859
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-54/#CVE-2023-6859
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-55/#CVE-2023-6859
• report
  https://access.redhat.com/security/cve/CVE-2023-6860
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6860
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6860
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-54/#CVE-2023-6860
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-55/#CVE-2023-6860
• report
  https://access.redhat.com/security/cve/CVE-2023-6861