Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 9

• Critical 9.8
  CVE-2023-5168

  A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds writ…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Sep 27, 2023
• Critical 9.8
  CVE-2023-5172

  A hashtable in the Ion Engine could have been mutated while there was a live interior reference, leading to a potential…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Sep 27, 2023
• Critical 9.8
  CVE-2023-5174

  If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointe…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Sep 27, 2023
• Critical 9.8
  CVE-2023-5175

  During process shutdown, it was possible that an `ImageBitmap` was created that would later be used after being freed f…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Sep 27, 2023
• Critical 9.8
  CVE-2023-5176

  Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Sep 27, 2023
• Unscored —
  CVE-2023-5169

  A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds wri…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Sep 27, 2023
• Unscored —
  CVE-2023-5170

  In canvas rendering, a compromised content process could have caused a surface to change unexpectedly, leading to a mem…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Sep 27, 2023
• Unscored —
  CVE-2023-5171

  During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Sep 27, 2023
• Unscored —
  CVE-2023-5173

  In a non-standard configuration of Firefox, an integer overflow could have occurred based on network traffic (possibly …

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Sep 27, 2023

Revision history

1. 2024-12-15 #16

   Neue Updates von openSUSE aufgenommen

2. 2024-03-03 #15

   Neue Updates von XEROX aufgenommen

3. 2024-02-18 #14

   Neue Updates von Gentoo aufgenommen

4. 2024-01-07 #13

   Neue Updates von Gentoo aufgenommen

5. 2023-11-28 #12

   Neue Updates von XEROX aufgenommen

6. 2023-11-16 #11

   Neue Updates von Amazon aufgenommen

7. 2023-10-12 #10

   Neue Updates von Oracle Linux aufgenommen

8. 2023-10-10 #9

   Neue Updates von Ubuntu aufgenommen

9. 2023-10-09 #8

   Neue Updates von SUSE und Debian aufgenommen

10. 2023-10-08 #7

    Neue Updates von Oracle Linux aufgenommen

11. 2023-10-05 #6

    Neue Updates von Oracle Linux und Red Hat aufgenommen

12. 2023-10-04 #5

    Neue Updates von Red Hat und Fedora aufgenommen

13. 2023-10-03 #4

    Neue Updates von Ubuntu und Debian aufgenommen

14. 2023-09-28 #3

    Neue Updates von Debian und Fedora aufgenommen

15. 2023-09-27 #2

    Neue Updates von SUSE aufgenommen

16. 2023-09-26 #1

    Initiale Fassung

References

• Mozilla Foundation Security Advisory 2023-41 vom 2023-09-26
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-41/
• Mozilla Foundation Security Advisory 2023-42 vom 2023-09-26
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-42/
• Mozilla Foundation Security Advisory 2023-43 vom 2023-09-26
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-43/
• SUSE Security Update SUSE-SU-2023:3837-1 vom 2023-09-27
  https://lists.suse.com/pipermail/sle-security-updates/2023-September/016355.html
• Debian Security Advisory DSA-5506 vom 2023-09-28
  https://lists.debian.org/debian-security-announce/2023/msg00199.html
• Fedora Security Advisory FEDORA-2023-770F96FBF4 vom 2023-09-28
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-770f96fbf4
• Ubuntu Security Notice USN-6404-1 vom 2023-10-03
  https://ubuntu.com/security/notices/USN-6404-1
• Debian Security Advisory DSA-5513 vom 2023-10-03
  https://lists.debian.org/debian-security-announce/2023/msg00206.html
• Ubuntu Security Notice USN-6405-1 vom 2023-10-03
  https://ubuntu.com/security/notices/USN-6405-1
• Red Hat Security Advisory RHSA-2023:5436 vom 2023-10-04
  https://access.redhat.com/errata/RHSA-2023:5436
• Red Hat Security Advisory RHSA-2023:5426 vom 2023-10-04
  https://access.redhat.com/errata/RHSA-2023:5426
• Red Hat Security Advisory RHSA-2023:5427 vom 2023-10-04
  https://access.redhat.com/errata/RHSA-2023:5427
• Red Hat Security Advisory RHSA-2023:5428 vom 2023-10-04
  https://access.redhat.com/errata/RHSA-2023:5428
• Red Hat Security Advisory RHSA-2023:5429 vom 2023-10-04
  https://access.redhat.com/errata/RHSA-2023:5429
• Red Hat Security Advisory RHSA-2023:5430 vom 2023-10-04
  https://access.redhat.com/errata/RHSA-2023:5430
• Red Hat Security Advisory RHSA-2023:5434 vom 2023-10-04
  https://access.redhat.com/errata/RHSA-2023:5434
• Red Hat Security Advisory RHSA-2023:5432 vom 2023-10-04
  https://access.redhat.com/errata/RHSA-2023:5432
• Red Hat Security Advisory RHSA-2023:5435 vom 2023-10-04
  https://access.redhat.com/errata/RHSA-2023:5435
• Red Hat Security Advisory RHSA-2023:5437 vom 2023-10-04
  https://access.redhat.com/errata/RHSA-2023:5437
• Red Hat Security Advisory RHSA-2023:5438 vom 2023-10-04
  https://access.redhat.com/errata/RHSA-2023:5438
• Red Hat Security Advisory RHSA-2023:5439 vom 2023-10-04
  https://access.redhat.com/errata/RHSA-2023:5439
• Fedora Security Advisory FEDORA-2023-BBB8D72C6F vom 2023-10-05
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-bbb8d72c6f
• Red Hat Security Advisory RHSA-2023:5440 vom 2023-10-04
  https://access.redhat.com/errata/RHSA-2023:5440
• Oracle Linux Security Advisory ELSA-2023-5435 vom 2023-10-05
  https://linux.oracle.com/errata/ELSA-2023-5435.html
• Red Hat Security Advisory RHSA-2023:5475 vom 2023-10-05
  https://access.redhat.com/errata/RHSA-2023:5475
• Red Hat Security Advisory RHSA-2023:5477 vom 2023-10-05
  https://access.redhat.com/errata/RHSA-2023:5477
• Oracle Linux Security Advisory ELSA-2023-5434 vom 2023-10-05
  https://linux.oracle.com/errata/ELSA-2023-5434.html
• Oracle Linux Security Advisory ELSA-2023-5428 vom 2023-10-07
  http://linux.oracle.com/errata/ELSA-2023-5428.html
• Oracle Linux Security Advisory ELSA-2023-5433 vom 2023-10-07
  http://linux.oracle.com/errata/ELSA-2023-5433.html
• SUSE Security Update SUSE-SU-2023:4016-1 vom 2023-10-09
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016575.html
• Debian Security Advisory DLA-3601 vom 2023-10-09
  https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
• Ubuntu Security Notice USN-6404-2 vom 2023-10-11
  https://ubuntu.com/security/notices/USN-6404-2
• Oracle Linux Security Advisory ELSA-2023-5475 vom 2023-10-12
  http://linux.oracle.com/errata/ELSA-2023-5475.html
• Oracle Linux Security Advisory ELSA-2023-5477 vom 2023-10-13
  https://linux.oracle.com/errata/ELSA-2023-5477.html
• Amazon Linux Security Advisory ALASFIREFOX-2023-017 vom 2023-11-17
  https://alas.aws.amazon.com/AL2/ALASFIREFOX-2023-017.html
• Xerox Security Bulletin XRX23-021
  https://securitydocs.business.xerox.com/wp-content/uploads/2023/11/XRX23-021_FFPSv2_Win10_SecurityBulletin_Nov2023.pdf
• Gentoo Linux Security Advisory GLSA-202401-10 vom 2024-01-07
  https://security.gentoo.org/glsa/202401-10
• Gentoo Linux Security Advisory GLSA-202402-25 vom 2024-02-19
  https://security.gentoo.org/glsa/202402-25
• XEROX Security Advisory XRX24-005 vom 2024-03-04
  https://security.business.xerox.com/wp-content/uploads/2024/03/Xerox-Security-Bulletin-XRX24-005-Xerox-FreeFlow%C2%AE-Print-Server-v9_Feb-2024.pdf
• XEROX Security Advisory XRX24-004 vom 2024-03-04
  https://security.business.xerox.com/wp-content/uploads/2024/03/Xerox%C2%AE-Security-Bulletin-XRX24-004-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v7.pdf
• openSUSE Security Update OPENSUSE-SU-2024:14572-1 vom 2024-12-13
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V/