Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 13

• High 7.5
  CVE-2023-5724

  Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Oct 24, 2023
• High 7.5
  CVE-2023-5728

  During garbage collection extra operations were performed on a object that should not be. This could have led to a pote…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Oct 24, 2023
• Medium 6.1
  CVE-2023-5758

  When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a refle…

  Mozilla Firefox for iOS iOS Browsers
  Oct 24, 2023
• Unscored —
  CVE-2023-5721

  It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Oct 24, 2023
• Unscored —
  CVE-2023-5722

  Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a ser…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu Alpine
  Oct 24, 2023
• Unscored —
  CVE-2023-5723

  An attacker with temporary script access to a site could have set a cookie containing invalid characters using `documen…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu Alpine
  Oct 24, 2023
• Unscored —
  CVE-2023-5725

  A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Oct 24, 2023
• Unscored —
  CVE-2023-5726

  A website could have obscured the full screen notification by using the file open dialog. This could have led to user c…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Oct 24, 2023
• Unscored —
  CVE-2023-5727

  The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Oct 24, 2023
• Unscored —
  CVE-2023-5729

  A malicious web site can enter fullscreen mode while simultaneously triggering a WebAuthn prompt. This could have obscu…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu Alpine
  Oct 24, 2023
• Unscored —
  CVE-2023-5730

  Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Oct 24, 2023
• Unscored —
  CVE-2023-5731

  Memory safety bugs present in Firefox 118. Some of these bugs showed evidence of memory corruption and we presume that …

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu Alpine
  Oct 24, 2023
• Unscored —
  CVE-2023-5732

  Address bar spoofing via bidirectional characters

  An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited. This vulnerability affects Firefox < 117, Firefox ESR < 115.4, and Thunderbird < 115.4.1.

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Oct 24, 2023

Revision history

1. 2024-12-15 #18

   Neue Updates von openSUSE aufgenommen

2. 2024-03-03 #17

   Neue Updates von XEROX aufgenommen

3. 2024-02-18 #16

   Neue Updates von Gentoo aufgenommen

4. 2024-01-07 #15

   Neue Updates von Gentoo aufgenommen

5. 2023-11-28 #14

   Neue Updates von XEROX aufgenommen

6. 2023-11-26 #13

   Neue Updates von SUSE aufgenommen

7. 2023-11-22 #12

   Neue Updates von SUSE aufgenommen

8. 2023-11-16 #11

   Neue Updates von Amazon aufgenommen

9. 2023-11-15 #10

   Neue Updates von Amazon aufgenommen

10. 2023-11-13 #9

    Neue Updates von Ubuntu aufgenommen

11. 2023-11-09 #8

    Neue Updates von IGEL aufgenommen

12. 2023-11-01 #7

    Neue Updates von Ubuntu aufgenommen

13. 2023-10-31 #6

    Neue Updates von Oracle Linux und SUSE aufgenommen

14. 2023-10-30 #5

    Neue Updates von Red Hat und Oracle Linux aufgenommen

15. 2023-10-29 #4

    Neue Updates von Ubuntu und Debian aufgenommen

16. 2023-10-26 #3

    Neue Updates von SUSE aufgenommen

17. 2023-10-25 #2

    Neue Updates von Fedora aufgenommen

18. 2023-10-24 #1

    Initiale Fassung

References

• Mozilla Foundation Security Advisory MFSA2023-45 vom 2023-10-24
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-45/
• Mozilla Foundation Security Advisory MFSA2023-46 vom 2023-10-24
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-46/
• Mozilla Foundation Security Advisory MFSA2023-47 vom 2023-10-24
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-47/
• Mozilla Foundation Security Advisory MFSA2023-48 vom 2023-10-24
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-48/
• Fedora Security Advisory FEDORA-2023-126CFFA741 vom 2023-10-26
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-126cffa741
• Fedora Security Advisory FEDORA-2023-253212D414 vom 2023-10-26
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-253212d414
• Fedora Security Advisory FEDORA-2023-107939D153 vom 2023-10-26
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-107939d153
• SUSE Security Update SUSE-SU-2023:4213-1 vom 2023-10-26
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016854.html
• SUSE Security Update SUSE-SU-2023:4212-1 vom 2023-10-26
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016855.html
• SUSE Security Update SUSE-SU-2023:4214-1 vom 2023-10-26
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016853.html
• Debian Security Advisory DLA-3632 vom 2023-10-27
  https://lists.debian.org/debian-lts-announce/2023/10/msg00037.html
• Ubuntu Security Notice USN-6456-1 vom 2023-10-30
  https://ubuntu.com/security/notices/USN-6456-1
• Debian Security Advisory DLA-3637 vom 2023-10-29
  https://lists.debian.org/debian-lts-announce/2023/10/msg00042.html
• Debian Security Advisory DSA-5538 vom 2023-10-28
  https://lists.debian.org/debian-security-announce/2023/msg00234.html
• Red Hat Security Advisory RHSA-2023:6195 vom 2023-10-31
  https://access.redhat.com/errata/RHSA-2023:6195
• Oracle Linux Security Advisory ELSA-2023-6162 vom 2023-10-30
  https://linux.oracle.com/errata/ELSA-2023-6162.html
• Red Hat Security Advisory RHSA-2023:6188 vom 2023-10-31
  https://access.redhat.com/errata/RHSA-2023:6188
• Red Hat Security Advisory RHSA-2023:6191 vom 2023-10-31
  https://access.redhat.com/errata/RHSA-2023:6191
• Red Hat Security Advisory RHSA-2023:6185 vom 2023-10-31
  https://access.redhat.com/errata/RHSA-2023:6185
• Red Hat Security Advisory RHSA-2023:6186 vom 2023-10-31
  https://access.redhat.com/errata/RHSA-2023:6186
• Red Hat Security Advisory RHSA-2023:6187 vom 2023-10-31
  https://access.redhat.com/errata/RHSA-2023:6187
• Red Hat Security Advisory RHSA-2023:6196 vom 2023-10-31
  https://access.redhat.com/errata/RHSA-2023:6196
• Red Hat Security Advisory RHSA-2023:6197 vom 2023-10-31
  https://access.redhat.com/errata/RHSA-2023:6197
• Red Hat Security Advisory RHSA-2023:6162 vom 2023-10-30
  https://access.redhat.com/errata/RHSA-2023:6162
• Red Hat Security Advisory RHSA-2023:6193 vom 2023-10-31
  https://access.redhat.com/errata/RHSA-2023:6193
• Red Hat Security Advisory RHSA-2023:6194 vom 2023-10-31
  https://access.redhat.com/errata/RHSA-2023:6194
• Red Hat Security Advisory RHSA-2023:6198 vom 2023-10-31
  https://access.redhat.com/errata/RHSA-2023:6198
• Red Hat Security Advisory RHSA-2023:6199 vom 2023-10-31
  https://access.redhat.com/errata/RHSA-2023:6199
• Oracle Linux Security Advisory ELSA-2023-6194 vom 2023-11-01
  http://linux.oracle.com/errata/ELSA-2023-6194.html
• Oracle Linux Security Advisory ELSA-2023-6191 vom 2023-11-01
  http://linux.oracle.com/errata/ELSA-2023-6191.html
• Oracle Linux Security Advisory ELSA-2023-6193 vom 2023-11-01
  http://linux.oracle.com/errata/ELSA-2023-6193.html
• SUSE Security Update SUSE-SU-2023:4302-1 vom 2023-10-31
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016943.html
• Oracle Linux Security Advisory ELSA-2023-6194 vom 2023-10-31
  https://linux.oracle.com/errata/ELSA-2023-6194.html
• Oracle Linux Security Advisory ELSA-2023-6187 vom 2023-11-01
  http://linux.oracle.com/errata/ELSA-2023-6187.html
• Oracle Linux Security Advisory ELSA-2023-6188 vom 2023-11-01
  https://linux.oracle.com/errata/ELSA-2023-6188.html
• Ubuntu Security Notice USN-6468-1 vom 2023-11-02
  https://ubuntu.com/security/notices/USN-6468-1
• IGEL Security Notice ISN-2023-28 vom 2023-11-09
  https://kb.igel.com/securitysafety/en/isn-2023-28-firefox-esr-vulnerabilities-105089372.html
• Ubuntu Security Notice USN-6456-2 vom 2023-11-14
  https://ubuntu.com/security/notices/USN-6456-2
• Amazon Linux Security Advisory ALAS-2023-2334 vom 2023-11-16
  https://alas.aws.amazon.com/AL2/ALAS-2023-2334.html
• Amazon Linux Security Advisory ALASFIREFOX-2023-017 vom 2023-11-17
  https://alas.aws.amazon.com/AL2/ALASFIREFOX-2023-017.html
• SUSE Security Update SUSE-SU-2023:4533-1 vom 2023-11-22
  https://lists.suse.com/pipermail/sle-security-updates/2023-November/017177.html
• SUSE Security Update SUSE-SU-2023:4532-1 vom 2023-11-22
  https://lists.suse.com/pipermail/sle-security-updates/2023-November/017178.html
• SUSE Security Update SUSE-SU-2023:4551-1 vom 2023-11-24
  https://lists.suse.com/pipermail/sle-security-updates/2023-November/017199.html
• Xerox Security Bulletin XRX23-021
  https://securitydocs.business.xerox.com/wp-content/uploads/2023/11/XRX23-021_FFPSv2_Win10_SecurityBulletin_Nov2023.pdf
• Gentoo Linux Security Advisory GLSA-202401-10 vom 2024-01-07
  https://security.gentoo.org/glsa/202401-10
• Gentoo Linux Security Advisory GLSA-202402-25 vom 2024-02-19
  https://security.gentoo.org/glsa/202402-25
• XEROX Security Advisory XRX24-005 vom 2024-03-04
  https://security.business.xerox.com/wp-content/uploads/2024/03/Xerox-Security-Bulletin-XRX24-005-Xerox-FreeFlow%C2%AE-Print-Server-v9_Feb-2024.pdf
• XEROX Security Advisory XRX24-004 vom 2024-03-04
  https://security.business.xerox.com/wp-content/uploads/2024/03/Xerox%C2%AE-Security-Bulletin-XRX24-004-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v7.pdf
• openSUSE Security Update OPENSUSE-SU-2024:14572-1 vom 2024-12-13
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V/