Summary
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2023-25750,
CVE-2023-25752, CVE-2023-28162, CVE-2023-28176, CVE-2023-28177)
Lukas Bernhard discovered that Firefox did not properly manage memory
when invalidating JIT code while following an iterator. An attacker could
potentially exploits this issue to cause a denial of service.
(CVE-2023-25751)
Rob Wu discovered that Firefox did not properly manage the URLs when
following a redirect to a publicly accessible web extension file. An
attacker could potentially exploits this to obtain sensitive information.
(CVE-2023-28160)
Luan Herrera discovered that Firefox did not properly manage cross-origin
iframe when dragging a URL. An attacker could potentially exploit this
issue to perform spoofing attacks. (CVE-2023-28164)
Khiem Tran discovered that Firefox did not properly manage one-time
permissions granted to a document loaded using a file: URL. An attacker
could potentially exploit this issue to use granted one-time permissions
on the local files came from different sources. (CVE-2023-28161)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 111.0+build2-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | firefox | 111.0+build2-0ubuntu0.20.04.1 |
Vulnerabilities 9
-
High 8.8
If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a f…
-
High 8.8
While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have…
-
High 8.8
Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruptio…
-
High 8.8
Memory safety bugs present in Firefox 110. Some of these bugs showed evidence of memory corruption and we presume that …
-
Medium 6.5
When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual l…
-
Medium 6.5
Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website…
-
Medium 4.3
Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private brow…
-
Unscored —
Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorr…
-
Unscored —
When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be withi…
References
-
report
https://ubuntu.com/security/CVE-2023-25750
-
report
https://ubuntu.com/security/CVE-2023-25751
-
report
https://ubuntu.com/security/CVE-2023-25752
-
report
https://ubuntu.com/security/CVE-2023-28160
-
report
https://ubuntu.com/security/CVE-2023-28161
-
report
https://ubuntu.com/security/CVE-2023-28162
-
report
https://ubuntu.com/security/CVE-2023-28164
-
report
https://ubuntu.com/security/CVE-2023-28176
-
report
https://ubuntu.com/security/CVE-2023-28177