Mozilla Firefox: Mehrere Schwachstellen ermöglichen Codeausführung

Summary

Product

Vulnerabilities 20

• Critical 9.8
  CVE-2023-25736

  An invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior. This vulnerability aff…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Jun 19, 2023
• High 8.8
  CVE-2023-0767

  An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 1…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25729

  Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensi…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25731

  Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Jun 2, 2023
• High 8.8
  CVE-2023-25732

  When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not c…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25735

  Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25737

  An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25739

  Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-fr…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-25740

  After downloading a Windows <code>.scf</code> script from the local filesystem, an attacker could supply a remote path …

  Mozilla Firefox Browsers
  Jun 2, 2023
• High 8.8
  CVE-2023-25745

  Memory safety bugs present in Firefox 109. Some of these bugs showed evidence of memory corruption and we presume that …

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Jun 2, 2023
• High 8.8
  CVE-2023-25746

  Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume…

  Mozilla Thunderbird Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.1
  CVE-2023-25734

  After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote pat…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Alpine
  Jun 2, 2023
• High 7.5
  CVE-2023-25733

  The return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Jun 19, 2023
• Medium 6.5
  CVE-2023-25728

  The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Medium 6.5
  CVE-2023-25738

  Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have res…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Alpine
  Jun 2, 2023
• Medium 6.5
  CVE-2023-25741

  When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipp…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Jun 2, 2023
• Medium 5.4
  CVE-2023-25730

  A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser i…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Unscored —
  CVE-2023-25742

  When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. Thi…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Unscored —
  CVE-2023-25743

  A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chro…

  Mozilla Firefox Firefox ESR Browsers
  Jun 2, 2023
• Unscored —
  CVE-2023-25744

  Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corrupti…

  Mozilla Firefox Firefox ESR mozjs38 Browsers Debian Ubuntu Alpine
  Jun 2, 2023

Revision history

1. 2023-09-27 #25

   Neue Updates von Amazon aufgenommen

2. 2023-08-17 #24

   Neue Updates von ORACLE aufgenommen

3. 2023-07-06 #23

   Neue Updates von IBM aufgenommen

4. 2023-05-29 #22

   Neue Updates von Gentoo aufgenommen

5. 2023-05-04 #21

   Neue Updates von Amazon aufgenommen

6. 2023-05-03 #20

   Neue Updates von Red Hat aufgenommen

7. 2023-04-16 #19

   Neue Updates von Red Hat aufgenommen

8. 2023-04-10 #18

   Neue Updates von Oracle Linux aufgenommen

9. 2023-03-27 #17

   Neue Updates von Red Hat aufgenommen

10. 2023-03-26 #16

    Neue Updates von NetApp aufgenommen

11. 2023-03-23 #15

    Neue Updates von Red Hat aufgenommen

12. 2023-03-22 #14

    Neue Updates von IGEL, Red Hat, XEROX und CentOS aufgenommen

13. 2023-03-21 #13

    Neue Updates von Oracle Linux, Red Hat und Amazon aufgenommen

14. 2023-03-20 #12

    Neue Updates von Oracle Linux und Red Hat aufgenommen

15. 2023-03-15 #11

    Neue Updates von Oracle Linux und Red Hat aufgenommen

16. 2023-03-06 #10

    Neue Updates von Ubuntu aufgenommen

17. 2023-02-28 #9

    Neue Updates von Ubuntu aufgenommen

18. 2023-02-27 #8

    Neue Updates von Ubuntu aufgenommen

19. 2023-02-22 #7

    Neue Updates von CentOS aufgenommen

20. 2023-02-21 #6

    Neue Updates von SUSE aufgenommen

21. 2023-02-20 #5

    Neue Updates von SUSE, Debian und Oracle Linux aufgenommen

22. 2023-02-19 #4

    Neue Updates von Ubuntu, SUSE und Debian aufgenommen

23. 2023-02-16 #3

    Neue Updates von Debian aufgenommen

24. 2023-02-15 #2

    Neue Updates von Debian aufgenommen

25. 2023-02-14 #1

    Initiale Fassung

References

• Amazon Linux Security Advisory ALASFIREFOX-2023-007 vom 2023-09-27
  https://alas.aws.amazon.com/AL2/ALASFIREFOX-2023-007.html
• ORACLE OVMSA-2023-0014 vom 2023-08-17
  https://oss.oracle.com/pipermail/oraclevm-errata/2023-August/001079.html
• IBM Security Bulletin 7010099 vom 2023-07-06
  https://www.ibm.com/support/pages/node/7010099
• Gentoo Linux Security Advisory GLSA-202305-35 vom 2023-05-30
  https://security.gentoo.org/glsa/202305-35
• Amazon Linux Security Advisory ALAS-2023-1736 vom 2023-05-04
  https://alas.aws.amazon.com/ALAS-2023-1736.html
• Red Hat Security Advisory RHSA-2023:2098 vom 2023-05-03
  https://access.redhat.com/errata/RHSA-2023:2098
• Red Hat Security Advisory RHSA-2023:1677 vom 2023-04-15
  https://access.redhat.com/errata/RHSA-2023:1677
• Oracle Linux Security Advisory ELSA-2023-12238 vom 2023-04-06
  http://linux.oracle.com/errata/ELSA-2023-12238.html
• Red Hat Security Advisory RHSA-2023:1479 vom 2023-03-27
  https://access.redhat.com/errata/RHSA-2023:1479
• NetApp Security Advisory NTAP-20230324-0008 vom 2023-03-24
  https://security.netapp.com/advisory/ntap-20230324-0008/
• Red Hat Security Advisory RHSA-2023:1436 vom 2023-03-23
  https://access.redhat.com/errata/RHSA-2023:1436
• CentOS Security Advisory CESA-2023:1332 vom 2023-03-22
  https://lists.centos.org/pipermail/centos-announce/2023-March/086393.html
• XEROX Security Advisory XRX23-002 vom 2023-03-23
  https://security.business.xerox.com/wp-content/uploads/2023/03/Xerox-Security-Bulletin-XRX23-002-FreeFlow-Print-Server-v2_Windows10.pdf
• Red Hat Security Advisory RHSA-2023:1406 vom 2023-03-22
  https://access.redhat.com/errata/RHSA-2023:1406
• IGEL Security Notice ISN-2023-02 vom 2023-03-22
  https://kb.igel.com/securitysafety/en/isn-2023-02-firefox-esr-vulnerabilities-81501314.html
• Amazon Linux Security Advisory ALAS-2023-1992 vom 2023-03-22
  https://alas.aws.amazon.com/AL2/ALAS-2023-1992.html
• Red Hat Security Advisory RHSA-2023:1370 vom 2023-03-21
  https://access.redhat.com/errata/RHSA-2023:1370
• Red Hat Security Advisory RHSA-2023:1368 vom 2023-03-21
  https://access.redhat.com/errata/RHSA-2023:1368
• Red Hat Security Advisory RHSA-2023:1366 vom 2023-03-21
  https://access.redhat.com/errata/RHSA-2023:1366
• Red Hat Security Advisory RHSA-2023:1369 vom 2023-03-21
  https://access.redhat.com/errata/RHSA-2023:1369
• Red Hat Security Advisory RHSA-2023:1365 vom 2023-03-21
  https://access.redhat.com/errata/RHSA-2023:1365
• Oracle Linux Security Advisory ELSA-2023-1368 vom 2023-03-22
  http://linux.oracle.com/errata/ELSA-2023-1368.html
• Red Hat Security Advisory RHSA-2023:1332 vom 2023-03-20
  https://access.redhat.com/errata/RHSA-2023:1332
• Oracle Linux Security Advisory ELSA-2023-1332 vom 2023-03-20
  http://linux.oracle.com/errata/ELSA-2023-1332.html
• Red Hat Security Advisory RHSA-2023:1252 vom 2023-03-15
  https://access.redhat.com/errata/RHSA-2023:1252
• Oracle Linux Security Advisory ELSA-2023-1252 vom 2023-03-15
  http://linux.oracle.com/errata/ELSA-2023-1252.html
• Ubuntu Security Notice USN-5892-2 vom 2023-03-06
  https://ubuntu.com/security/notices/USN-5892-2
• Ubuntu Security Notice USN-5880-2 vom 2023-03-01
  https://ubuntu.com/security/notices/USN-5880-2
• Ubuntu Security Notice USN-5892-1 vom 2023-02-27
  https://ubuntu.com/security/notices/USN-5892-1
• Mozilla Foundation Security Advisory vom 2023-02-14
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-05/
• Mozilla Foundation Security Advisory vom 2023-02-14
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-06/
• Debian Security Advisory DSA-5350 vom 2023-02-15
  https://lists.debian.org/debian-security-announce/2023/msg00039.html
• SUSE Security Update SUSE-SU-2023:0434-1 vom 2023-02-16
  https://lists.suse.com/pipermail/sle-security-updates/2023-February/013802.html
• Debian Security Advisory DLA-3319 vom 2023-02-16
  https://lists.debian.org/debian-lts-announce/2023/02/msg00013.html
• Ubuntu Security Notice USN-5880-1 vom 2023-02-20
  https://ubuntu.com/security/notices/USN-5880-1
• SUSE Security Update SUSE-SU-2023:0443-1 vom 2023-02-17
  https://lists.suse.com/pipermail/sle-security-updates/2023-February/013833.html
• Debian Security Advisory DSA-5353 vom 2023-02-18
  https://www.debian.org/security/2023/dsa-5353
• Red Hat Security Advisory RHSA-2023:0812 vom 2023-02-20
  https://access.redhat.com/errata/RHSA-2023:0812
• Red Hat Security Advisory RHSA-2023:0805 vom 2023-02-20
  https://access.redhat.com/errata/RHSA-2023:0805
• Red Hat Security Advisory RHSA-2023:0809 vom 2023-02-20
  https://access.redhat.com/errata/RHSA-2023:0809
• Red Hat Security Advisory RHSA-2023:0806 vom 2023-02-20
  https://access.redhat.com/errata/RHSA-2023:0806
• Red Hat Security Advisory RHSA-2023:0811 vom 2023-02-20
  https://access.redhat.com/errata/RHSA-2023:0811
• Red Hat Security Advisory RHSA-2023:0810 vom 2023-02-20
  https://access.redhat.com/errata/RHSA-2023:0810
• Red Hat Security Advisory RHSA-2023:0808 vom 2023-02-20
  https://access.redhat.com/errata/RHSA-2023:0808
• Red Hat Security Advisory RHSA-2023:0807 vom 2023-02-20
  https://access.redhat.com/errata/RHSA-2023:0807
• SUSE Security Update SUSE-SU-2023:0461-1 vom 2023-02-20
  https://lists.suse.com/pipermail/sle-security-updates/2023-February/013843.html
• Debian Security Advisory DLA-3327 vom 2023-02-20
  https://lists.debian.org/debian-lts-announce/2023/02/msg00021.html
• Oracle Linux Security Advisory ELSA-2023-0812 vom 2023-02-21
  https://linux.oracle.com/errata/ELSA-2023-0812.html
• Oracle Linux Security Advisory ELSA-2023-0810 vom 2023-02-21
  https://linux.oracle.com/errata/ELSA-2023-0810.html
• Oracle Linux Security Advisory ELSA-2023-0808 vom 2023-02-20
  https://linux.oracle.com/errata/ELSA-2023-0808.html
• SUSE Security Update SUSE-SU-2023:0466-1 vom 2023-02-21
  https://lists.suse.com/pipermail/sle-security-updates/2023-February/013853.html
• SUSE Security Update SUSE-SU-2023:0466-1 vom 2023-02-21
  https://lists.suse.com/pipermail/sle-security-updates/2023-February/013858.html
• SUSE Security Update SUSE-SU-2023:0468-1 vom 2023-02-21
  https://lists.suse.com/pipermail/sle-security-updates/2023-February/013851.html
• SUSE Security Update SUSE-SU-2023:0469-1 vom 2023-02-21
  https://lists.suse.com/pipermail/sle-security-updates/2023-February/013850.html
• CentOS Security Advisory CESA-2023:0812 vom 2023-02-22
  https://lists.centos.org/pipermail/centos-announce/2023-February/086376.html