Summary
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2023-34414,
CVE-2023-34416, CVE-2023-34417)
Jun Kokatsu discovered that Firefox did not properly validate site-isolated
process for a document loaded from a data: URL that was the result of a
redirect, leading to an open redirect attack. An attacker could possibly
use this issue to perform phishing attacks. (CVE-2023-34415)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | firefox | 114.0+build3-0ubuntu0.20.04.1 |
Vulnerabilities 4
-
Critical 9.8
Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that …
-
Unscored —
The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts…
-
Unscored —
When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox…
-
Unscored —
Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed eviden…