Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 25

• Critical 9.8
  CVE-2023-29531

  An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a poten…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Jun 19, 2023
• Critical 9.8
  CVE-2023-29542

  A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious fi…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Jun 19, 2023
• Critical 9.1
  CVE-2023-29534

  Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have …

  Mozilla Firefox for Android Focus for Android mozjs38 Android Browsers Ubuntu
  Jun 19, 2023
• High 8.8
  CVE-2023-29541

  Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run att…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-29543

  An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global o…

  Mozilla Firefox Firefox for Android Focus for Android Android Browsers Ubuntu
  Jun 2, 2023
• High 8.8
  CVE-2023-29550

  Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruptio…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• High 8.8
  CVE-2023-29551

  Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that …

  Mozilla Firefox Firefox for Android Focus for Android Android Browsers Ubuntu
  Jun 2, 2023
• Medium 6.5
  CVE-2023-0547

  OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certi…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Jun 2, 2023
• Medium 6.5
  CVE-2023-1945

  Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable c…

  Mozilla Thunderbird Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Medium 6.5
  CVE-2023-28163

  When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable n…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Alpine
  Jun 2, 2023
• Medium 6.5
  CVE-2023-29544

  If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused me…

  Mozilla Firefox Firefox for Android Focus for Android Android Browsers Ubuntu
  Jun 2, 2023
• Medium 6.5
  CVE-2023-29545

  Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Jun 19, 2023
• Medium 6.5
  CVE-2023-29546

  When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden…

  Mozilla Firefox for Android Focus for Android mozjs38 Android Browsers Ubuntu
  Jun 19, 2023
• Medium 6.5
  CVE-2023-29547

  When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, …

  Mozilla Firefox Firefox for Android Focus for Android Android Browsers Ubuntu
  Jun 2, 2023
• Medium 6.5
  CVE-2023-29548

  A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affe…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Medium 6.5
  CVE-2023-29549

  Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This ma…

  Mozilla Firefox Firefox for Android Focus for Android Android Browsers Ubuntu
  Jun 2, 2023
• Medium 5.5
  CVE-2023-29532

  A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the servic…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Jun 19, 2023
• Medium 5.3
  CVE-2023-29479

  Ribose RNP before 0.16.3 may hang when the input is malformed.

  thunderbird thunderbird rnp Debian Ubuntu
  Apr 24, 2023
• Unscored —
  CVE-2023-29533

  A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscree…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Unscored —
  CVE-2023-29535

  Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resu…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Unscored —
  CVE-2023-29536

  An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, res…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Unscored —
  CVE-2023-29537

  Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-contr…

  Mozilla Firefox Firefox for Android Focus for Android Android Browsers Ubuntu
  Jun 2, 2023
• Unscored —
  CVE-2023-29538

  Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-ex…

  Mozilla Firefox Firefox for Android Focus for Android Android Browsers Ubuntu
  Jun 2, 2023
• Unscored —
  CVE-2023-29539

  When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Jun 2, 2023
• Unscored —
  CVE-2023-29540

  Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in …

  Mozilla Firefox Firefox for Android Focus for Android Android Browsers Ubuntu
  Jun 2, 2023

Revision history

1. 2023-09-27 #14

   Neue Updates von Amazon aufgenommen

2. 2023-06-20 #13

   Neue Updates von XEROX aufgenommen

3. 2023-05-29 #12

   Neue Updates von Gentoo aufgenommen

4. 2023-05-02 #11

   Neue Updates von Amazon aufgenommen

5. 2023-05-01 #10

   Neue Updates von SUSE aufgenommen

6. 2023-04-25 #9

   Neue Updates von Ubuntu aufgenommen

7. 2023-04-24 #8

   Neue Updates von Debian und CentOS aufgenommen

8. 2023-04-23 #7

   Neue Updates von Debian aufgenommen

9. 2023-04-18 #6

   Neue Updates von Oracle Linux aufgenommen

10. 2023-04-17 #5

    Neue Updates von Red Hat, Ubuntu und Oracle Linux aufgenommen

11. 2023-04-16 #4

    Neue Updates von Oracle Linux, Red Hat und SUSE aufgenommen

12. 2023-04-13 #3

    Neue Updates von Fedora aufgenommen

13. 2023-04-12 #2

    Neue Updates von Debian und Ubuntu aufgenommen

14. 2023-04-11 #1

    Initiale Fassung

References

• Amazon Linux Security Advisory ALASFIREFOX-2023-006 vom 2023-09-27
  https://alas.aws.amazon.com/AL2/ALASFIREFOX-2023-006.html
• XEROX Security Advisory XRX23-010 vom 2023-06-21
  https://securitydocs.business.xerox.com/wp-content/uploads/2023/06/Xerox-Security-Bulletin-XRX23-010-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v2_Windows%C2%AE-10.pdf
• Gentoo Linux Security Advisory GLSA-202305-36 vom 2023-05-30
  https://security.gentoo.org/glsa/202305-36
• Gentoo Linux Security Advisory GLSA-202305-35 vom 2023-05-30
  https://security.gentoo.org/glsa/202305-35
• Amazon Linux Security Advisory ALAS-2023-2028 vom 2023-05-03
  https://alas.aws.amazon.com/AL2/ALAS-2023-2028.html
• SUSE Security Update SUSE-SU-2023:2064-1 vom 2023-04-28
  https://lists.suse.com/pipermail/sle-security-updates/2023-April/014672.html
• Ubuntu Security Notice USN-6010-3 vom 2023-04-26
  https://ubuntu.com/security/notices/USN-6010-3
• CentOS Security Advisory CESA-2023:1791 vom 2023-04-24
  https://lists.centos.org/pipermail/centos-announce/2023-April/086396.html
• CentOS Security Advisory CESA-2023:1806 vom 2023-04-24
  https://lists.centos.org/pipermail/centos-announce/2023-April/086395.html
• Debian Security Advisory DLA-3400 vom 2023-04-24
  https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html
• Debian Security Advisory DSA-5392 vom 2023-04-23
  https://www.debian.org/security/2023/dsa-5392
• Oracle Linux Security Advisory ELSA-2023-1791 vom 2023-04-18
  https://oss.oracle.com/pipermail/el-errata/2023-April/013926.html
• Red Hat Security Advisory RHSA-2023:1802 vom 2023-04-17
  https://access.redhat.com/errata/RHSA-2023:1802
• Red Hat Security Advisory RHSA-2023:1811 vom 2023-04-17
  https://access.redhat.com/errata/RHSA-2023:1811
• Red Hat Security Advisory RHSA-2023:1809 vom 2023-04-17
  https://access.redhat.com/errata/RHSA-2023:1809
• Red Hat Security Advisory RHSA-2023:1805 vom 2023-04-17
  https://access.redhat.com/errata/RHSA-2023:1805
• Red Hat Security Advisory RHSA-2023:1804 vom 2023-04-17
  https://access.redhat.com/errata/RHSA-2023:1804
• Red Hat Security Advisory RHSA-2023:1806 vom 2023-04-17
  https://access.redhat.com/errata/RHSA-2023:1806
• Red Hat Security Advisory RHSA-2023:1803 vom 2023-04-17
  https://access.redhat.com/errata/RHSA-2023:1803
• Oracle Linux Security Advisory ELSA-2023-1809 vom 2023-04-18
  https://linux.oracle.com/errata/ELSA-2023-1809.html
• Oracle Linux Security Advisory ELSA-2023-1802 vom 2023-04-18
  https://linux.oracle.com/errata/ELSA-2023-1802.html
• Oracle Linux Security Advisory ELSA-2023-1806 vom 2023-04-18
  https://linux.oracle.com/errata/ELSA-2023-1806.html
• Ubuntu Security Notice USN-6010-2 vom 2023-04-18
  https://ubuntu.com/security/notices/USN-6010-2
• Red Hat Security Advisory RHSA-2023:1810 vom 2023-04-17
  https://access.redhat.com/errata/RHSA-2023:1810
• Red Hat Security Advisory RHSA-2023:1787 vom 2023-04-14
  https://access.redhat.com/errata/RHSA-2023:1787
• Red Hat Security Advisory RHSA-2023:1786 vom 2023-04-14
  https://access.redhat.com/errata/RHSA-2023:1786
• Oracle Linux Security Advisory ELSA-2023-1786 vom 2023-04-15
  https://oss.oracle.com/pipermail/el-errata/2023-April/013914.html
• Red Hat Security Advisory RHSA-2023:1791 vom 2023-04-14
  https://access.redhat.com/errata/RHSA-2023:1791
• Red Hat Security Advisory RHSA-2023:1790 vom 2023-04-14
  https://access.redhat.com/errata/RHSA-2023:1790
• Red Hat Security Advisory RHSA-2023:1789 vom 2023-04-14
  https://access.redhat.com/errata/RHSA-2023:1789
• Red Hat Security Advisory RHSA-2023:1788 vom 2023-04-14
  https://access.redhat.com/errata/RHSA-2023:1788
• Red Hat Security Advisory RHSA-2023:1792 vom 2023-04-14
  https://access.redhat.com/errata/RHSA-2023:1792
• SUSE Security Update SUSE-SU-2023:1855-1 vom 2023-04-14
  https://lists.suse.com/pipermail/sle-security-updates/2023-April/014459.html
• Red Hat Security Advisory RHSA-2023:1785 vom 2023-04-14
  https://access.redhat.com/errata/RHSA-2023:1785
• Oracle Linux Security Advisory ELSA-2023-1787 vom 2023-04-15
  https://oss.oracle.com/pipermail/el-errata/2023-April/013913.html
• Fedora Security Advisory FEDORA-2023-6C3278C87B vom 2023-04-14
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-6c3278c87b
• Fedora Security Advisory FEDORA-2023-0B5CCD1812 vom 2023-04-13
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-0b5ccd1812
• Ubuntu Security Notice USN-6015-1 vom 2023-04-13
  https://ubuntu.com/security/notices/USN-6015-1
• Debian Security Advisory DLA-3391 vom 2023-04-12
  https://lists.debian.org/debian-lts-announce/2023/04/msg00016.html
• Debian Security Advisory DSA-5385 vom 2023-04-12
  https://lists.debian.org/debian-security-announce/2023/msg00075.html
• Ubuntu Security Notice USN-6010-1 vom 2023-04-12
  https://ubuntu.com/security/notices/USN-6010-1
• Fedora Update FEDORA-2023-a2a92ab69a vom 2023-04-11
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-a2a92ab69a
• Fedora Update FEDORA-2023-d365f19e05 vom 2023-04-11
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-d365f19e05
• SUSE Security Update SUSE-SU-2023:1819-1 vom 2023-04-011
  https://lists.suse.com/pipermail/sle-security-updates/2023-April/014443.html
• SUSE Security Update SUSE-SU-2023:1817-1 vom 2023-04-011
  https://lists.suse.com/pipermail/sle-security-updates/2023-April/014444.html
• Mozilla Foundation Security Advisory vom 2023-04-11
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/
• Mozilla Foundation Security Advisory vom 2023-04-11
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/
• Mozilla Foundation Security Advisory vom 2023-04-11
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-13/