Mozilla Firefox und Mozilla Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 14

• Unscored —
  CVE-2023-4045

  Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from ano…

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4046

  In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in …

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4047

  A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into grantin…

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4048

  An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations.…

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4049

  Race conditions in reference counting code were found through code inspection. These could have resulted in potentially…

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4050 EPSS 13%

  In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a pot…

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4051

  Full screen notification obscured by file open dialog

  A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4052

  The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4053

  Full screen notification obscured by external program

  A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefo…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4054

  When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4055

  When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no …

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4056

  Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 10…

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4057

  Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Aug 1, 2023
• Unscored —
  CVE-2023-4058

  Memory safety bugs present in Firefox 115. Some of these bugs showed evidence of memory corruption and we presume that …

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Aug 1, 2023

Revision history

1. 2024-03-03 #20

   Neue Updates von XEROX aufgenommen

2. 2024-02-18 #19

   Neue Updates von Gentoo aufgenommen

3. 2024-01-07 #18

   Neue Updates von Gentoo aufgenommen

4. 2023-11-28 #17

   Neue Updates von XEROX aufgenommen

5. 2023-10-03 #16

   Neue Updates von Ubuntu aufgenommen

6. 2023-09-27 #15

   Neue Updates von Amazon aufgenommen

7. 2023-09-20 #14

   Neue Updates von Fedora und Amazon aufgenommen

8. 2023-09-18 #13

   Neue Updates von SUSE aufgenommen

9. 2023-09-07 #12

   Neue Updates von Oracle Linux und Red Hat aufgenommen

10. 2023-09-05 #11

    Neue Updates von SUSE und Oracle Linux aufgenommen

11. 2023-09-03 #10

    Neue Updates von Ubuntu aufgenommen

12. 2023-08-29 #9

    Neue Updates von Mozilla aufgenommen

13. 2023-08-20 #8

    Neue Updates von Ubuntu aufgenommen

14. 2023-08-09 #7

    Neue Updates von Debian aufgenommen

15. 2023-08-08 #6

    Neue Updates von Oracle Linux und SUSE aufgenommen

16. 2023-08-07 #5

    Neue Updates von Oracle Linux, Red Hat und Ubuntu aufgenommen

17. 2023-08-06 #4

    Neue Updates von Oracle Linux und Debian aufgenommen

18. 2023-08-03 #3

    Neue Updates von Red Hat und Debian aufgenommen

19. 2023-08-02 #2

    Neue Updates von SUSE und Mozilla aufgenommen

20. 2023-08-01 #1

    Initiale Fassung

References

• Mozilla Firefox Security Advisory vom 2023-08-01
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-29/
• Mozilla Firefox Security Advisory vom 2023-08-01
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-30/
• Mozilla Firefox Security Advisory vom 2023-08-01
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/
• Ubuntu Security Notice USN-6267-1 vom 2023-08-02
  https://ubuntu.com/security/notices/USN-6267-1
• SUSE Security Update SUSE-SU-2023:3162-1 vom 2023-08-02
  https://lists.suse.com/pipermail/sle-security-updates/2023-August/015759.html
• Mozilla Security Advisory MFSA2023-32 vom 2023-08-03
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-32/
• Mozilla Security Advisory MFSA2023-33 vom 2023-08-03
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-33/
• SUSE Security Update SUSE-SU-2023:3161-1 vom 2023-08-02
  https://lists.suse.com/pipermail/sle-security-updates/2023-August/015760.html
• SUSE Security Update SUSE-SU-2023:3163-1 vom 2023-08-02
  https://lists.suse.com/pipermail/sle-security-updates/2023-August/015758.html
• Red Hat Security Advisory RHSA-2023:4462 vom 2023-08-03
  https://access.redhat.com/errata/RHSA-2023:4462
• Red Hat Security Advisory RHSA-2023:4463 vom 2023-08-03
  https://access.redhat.com/errata/RHSA-2023:4463
• Red Hat Security Advisory RHSA-2023:4464 vom 2023-08-03
  https://access.redhat.com/errata/RHSA-2023:4464
• Red Hat Security Advisory RHSA-2023:4465 vom 2023-08-03
  https://access.redhat.com/errata/RHSA-2023:4465
• Red Hat Security Advisory RHSA-2023:4460 vom 2023-08-03
  https://access.redhat.com/errata/RHSA-2023:4460
• Red Hat Security Advisory RHSA-2023:4468 vom 2023-08-03
  https://access.redhat.com/errata/RHSA-2023:4468
• Red Hat Security Advisory RHSA-2023:4469 vom 2023-08-03
  https://access.redhat.com/errata/RHSA-2023:4469
• Red Hat Security Advisory RHSA-2023:4461 vom 2023-08-03
  https://access.redhat.com/errata/RHSA-2023:4461
• Debian Security Advisory DSA-5464 vom 2023-08-03
  https://lists.debian.org/debian-security-announce/2023/msg00156.html
• Oracle Linux Security Advisory ELSA-2023-4462 vom 2023-08-04
  https://linux.oracle.com/errata/ELSA-2023-4462.html
• Oracle Linux Security Advisory ELSA-2023-4461 vom 2023-08-04
  https://linux.oracle.com/errata/ELSA-2023-4461.html
• Debian Security Advisory DSA-5469 vom 2023-08-05
  https://lists.debian.org/debian-security-announce/2023/msg00161.html
• Oracle Linux Security Advisory ELSA-2023-4468 vom 2023-08-04
  https://linux.oracle.com/errata/ELSA-2023-4468.html
• Red Hat Security Advisory RHSA-2023:4492 vom 2023-08-07
  https://access.redhat.com/errata/RHSA-2023:4492
• Oracle Linux Security Advisory ELSA-2023-4499 vom 2023-08-08
  https://linux.oracle.com/errata/ELSA-2023-4499.html
• Red Hat Security Advisory RHSA-2023:4494 vom 2023-08-07
  https://access.redhat.com/errata/RHSA-2023:4494
• Red Hat Security Advisory RHSA-2023:4500 vom 2023-08-07
  https://access.redhat.com/errata/RHSA-2023:4500
• Red Hat Security Advisory RHSA-2023:4499 vom 2023-08-07
  https://access.redhat.com/errata/RHSA-2023:4499
• Red Hat Security Advisory RHSA-2023:4497 vom 2023-08-07
  https://access.redhat.com/errata/RHSA-2023:4497
• Red Hat Security Advisory RHSA-2023:4495 vom 2023-08-07
  https://access.redhat.com/errata/RHSA-2023:4495
• Ubuntu Security Notice USN-6267-2 vom 2023-08-08
  https://ubuntu.com/security/notices/USN-6267-2
• Oracle Linux Security Advisory ELSA-2023-4495 vom 2023-08-08
  https://linux.oracle.com/errata/ELSA-2023-4495.html
• Red Hat Security Advisory RHSA-2023:4496 vom 2023-08-07
  https://access.redhat.com/errata/RHSA-2023:4496
• Red Hat Security Advisory RHSA-2023:4493 vom 2023-08-07
  https://access.redhat.com/errata/RHSA-2023:4493
• Debian Security Advisory DLA-3521 vom 2023-08-08
  https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html
• Oracle Linux Security Advisory ELSA-2023-4497 vom 2023-08-09
  https://linux.oracle.com/errata/ELSA-2023-4497.html
• SUSE Security Update SUSE-SU-2023:3228-1 vom 2023-08-08
  https://lists.suse.com/pipermail/sle-security-updates/2023-August/015804.html
• Debian Security Advisory DLA-3523 vom 2023-08-09
  https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
• Ubuntu Security Notice USN-6267-3 vom 2023-08-21
  https://ubuntu.com/security/notices/USN-6267-3
• Mozilla Security Advisory MFSA2023-36 vom 2023-08-29
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/
• Ubuntu Security Notice USN-6333-1 vom 2023-09-04
  https://ubuntu.com/security/notices/USN-6333-1
• SUSE Security Update SUSE-SU-2023:3519-1 vom 2023-09-05
  https://lists.suse.com/pipermail/sle-security-updates/2023-September/016095.html
• Oracle Linux Security Advisory ELSA-2023-4945 vom 2023-09-05
  https://linux.oracle.com/errata/ELSA-2023-4945.html
• Oracle Linux Security Advisory ELSA-2023-5019 vom 2023-09-08
  https://linux.oracle.com/errata/ELSA-2023-5019.html
• Red Hat Security Advisory RHSA-2023:5019 vom 2023-09-07
  https://access.redhat.com/errata/RHSA-2023:5019
• Oracle Linux Security Advisory ELSA-2023-4958 vom 2023-09-08
  http://linux.oracle.com/errata/ELSA-2023-4958.html
• SUSE Security Update SUSE-SU-2023:3664-1 vom 2023-09-18
  https://lists.suse.com/pipermail/sle-security-updates/2023-September/016188.html
• Fedora Security Advisory FEDORA-2023-1BCD79CDF6 vom 2023-09-21
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-1bcd79cdf6
• Amazon Linux Security Advisory ALAS-2023-2248 vom 2023-09-21
  https://alas.aws.amazon.com/AL2/ALAS-2023-2248.html
• Amazon Linux Security Advisory ALASFIREFOX-2023-002 vom 2023-09-27
  https://alas.aws.amazon.com/AL2/ALASFIREFOX-2023-002.html
• Ubuntu Security Notice USN-6405-1 vom 2023-10-03
  https://ubuntu.com/security/notices/USN-6405-1
• Ubuntu Security Notice USN-6406-1 vom 2023-10-03
  https://ubuntu.com/security/notices/USN-6406-1
• Xerox Security Bulletin XRX23-021
  https://securitydocs.business.xerox.com/wp-content/uploads/2023/11/XRX23-021_FFPSv2_Win10_SecurityBulletin_Nov2023.pdf
• Gentoo Linux Security Advisory GLSA-202401-10 vom 2024-01-07
  https://security.gentoo.org/glsa/202401-10
• Gentoo Linux Security Advisory GLSA-202402-25 vom 2024-02-19
  https://security.gentoo.org/glsa/202402-25
• XEROX Security Advisory XRX24-005 vom 2024-03-04
  https://security.business.xerox.com/wp-content/uploads/2024/03/Xerox-Security-Bulletin-XRX24-005-Xerox-FreeFlow%C2%AE-Print-Server-v9_Feb-2024.pdf
• XEROX Security Advisory XRX24-004 vom 2024-03-04
  https://security.business.xerox.com/wp-content/uploads/2024/03/Xerox%C2%AE-Security-Bulletin-XRX24-004-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v7.pdf