Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 12

• Unscored —
  CVE-2023-49060

  An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referre…

  Mozilla Firefox for iOS iOS Browsers
  Nov 21, 2023
• Unscored —
  CVE-2023-49061

  An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnera…

  Mozilla Firefox for iOS iOS Browsers
  Nov 21, 2023
• Unscored —
  CVE-2023-6204

  On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Nov 21, 2023
• Unscored —
  CVE-2023-6205

  It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Nov 21, 2023
• Unscored —
  CVE-2023-6206

  The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission pro…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Nov 21, 2023
• Unscored —
  CVE-2023-6207

  Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefo…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Nov 21, 2023
• Unscored —
  CVE-2023-6208

  When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Nov 21, 2023
• Unscored —
  CVE-2023-6209

  Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could b…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Nov 21, 2023
• Unscored —
  CVE-2023-6210

  When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed to load blockabl…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Nov 21, 2023
• Unscored —
  CVE-2023-6211

  If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacke…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Nov 21, 2023
• Unscored —
  CVE-2023-6212

  Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Nov 21, 2023
• Unscored —
  CVE-2023-6213

  Memory safety bugs present in Firefox 119. Some of these bugs showed evidence of memory corruption and we presume that …

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Nov 21, 2023

Revision history

1. 2024-12-15 #16

   Neue Updates von openSUSE aufgenommen

2. 2024-02-18 #15

   Neue Updates von Gentoo aufgenommen

3. 2024-01-31 #14

   Neue Updates von IGEL aufgenommen

4. 2024-01-09 #13

   Neue Updates von Amazon aufgenommen

5. 2024-01-07 #12

   Neue Updates von Gentoo aufgenommen

6. 2023-12-20 #11

   Neue Updates von SUSE aufgenommen

7. 2023-12-19 #10

   Neue Updates von SUSE aufgenommen

8. 2023-12-03 #9

   Neue Updates von Ubuntu aufgenommen

9. 2023-11-30 #8

   Neue Updates von Debian aufgenommen

10. 2023-11-29 #7

    Neue Updates von Red Hat aufgenommen

11. 2023-11-28 #6

    Neue Updates von Red Hat und Oracle Linux aufgenommen

12. 2023-11-27 #5

    Neue Updates von SUSE und Red Hat aufgenommen

13. 2023-11-26 #4

    Neue Updates von Ubuntu, Debian und Fedora aufgenommen

14. 2023-11-23 #3

    Neue Updates von Debian aufgenommen

15. 2023-11-22 #2

    Neue Updates von Debian und Ubuntu aufgenommen

16. 2023-11-21 #1

    Initiale Fassung

References

• Mozilla Security Advisory vom 2023-11-21
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-49/
• Mozilla Security Advisory vom 2023-11-21
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-50/
• Mozilla Security Advisory vom 2023-11-21
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-51/
• Mozilla Security Advisory vom 2023-11-21
  https://www.mozilla.org/en-US/security/advisories/mfsa2023-52/
• Debian Security Advisory DSA-5561 vom 2023-11-22
  https://lists.debian.org/debian-security-announce/2023/msg00257.html
• Ubuntu Security Notice USN-6509-1 vom 2023-11-23
  https://ubuntu.com/security/notices/USN-6509-1
• Debian Security Advisory DLA-3661 vom 2023-11-24
  https://lists.debian.org/debian-lts-announce/2023/11/msg00017.html
• Ubuntu Security Notice USN-6515-1 vom 2023-11-27
  https://ubuntu.com/security/notices/USN-6515-1
• Debian Security Advisory DSA-5566 vom 2023-11-26
  https://lists.debian.org/debian-security-announce/2023/msg00262.html
• Fedora Security Advisory FEDORA-2023-BB021A4854 vom 2023-11-24
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-bb021a4854
• Fedora Security Advisory FEDORA-2023-985A025A03 vom 2023-11-24
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-985a025a03
• SUSE Security Update SUSE-SU-2023:4588-1 vom 2023-11-27
  https://lists.suse.com/pipermail/sle-security-updates/2023-November/017238.html
• Red Hat Security Advisory RHSA-2023:7512 vom 2023-11-27
  https://access.redhat.com/errata/RHSA-2023:7512
• Red Hat Security Advisory RHSA-2023:7511 vom 2023-11-27
  https://access.redhat.com/errata/RHSA-2023:7511
• Red Hat Security Advisory RHSA-2023:7510 vom 2023-11-27
  https://access.redhat.com/errata/RHSA-2023:7510
• Red Hat Security Advisory RHSA-2023:7509 vom 2023-11-27
  https://access.redhat.com/errata/RHSA-2023:7509
• Red Hat Security Advisory RHSA-2023:7508 vom 2023-11-27
  https://access.redhat.com/errata/RHSA-2023:7508
• Red Hat Security Advisory RHSA-2023:7507 vom 2023-11-27
  https://access.redhat.com/errata/RHSA-2023:7507
• Red Hat Security Advisory RHSA-2023:7506 vom 2023-11-27
  https://access.redhat.com/errata/RHSA-2023:7506
• Red Hat Security Advisory RHSA-2023:7505 vom 2023-11-27
  https://access.redhat.com/errata/RHSA-2023:7505
• Red Hat Security Advisory RHSA-2023:7504 vom 2023-11-27
  https://access.redhat.com/errata/RHSA-2023:7504
• Red Hat Security Advisory RHSA-2023:7503 vom 2023-11-27
  https://access.redhat.com/errata/RHSA-2023:7503
• Red Hat Security Advisory RHSA-2023:7502 vom 2023-11-27
  https://access.redhat.com/errata/RHSA-2023:7502
• Red Hat Security Advisory RHSA-2023:7501 vom 2023-11-27
  https://access.redhat.com/errata/RHSA-2023:7501
• Red Hat Security Advisory RHSA-2023:7500 vom 2023-11-27
  https://access.redhat.com/errata/RHSA-2023:7500
• Red Hat Security Advisory RHSA-2023:7499 vom 2023-11-27
  https://access.redhat.com/errata/RHSA-2023:7499
• Red Hat Security Advisory RHSA-2023:7547 vom 2023-11-28
  https://access.redhat.com/errata/RHSA-2023:7547
• Oracle Linux Security Advisory ELSA-2023-7505 vom 2023-11-28
  https://linux.oracle.com/errata/ELSA-2023-7505.html
• Oracle Linux Security Advisory ELSA-2023-7509 vom 2023-11-28
  https://linux.oracle.com/errata/ELSA-2023-7509.html
• Oracle Linux Security Advisory ELSA-2023-7507 vom 2023-11-28
  https://linux.oracle.com/errata/ELSA-2023-7507.html
• Oracle Linux Security Advisory ELSA-2023-7501 vom 2023-11-28
  https://linux.oracle.com/errata/ELSA-2023-7501.html
• Oracle Linux Security Advisory ELSA-2023-7508 vom 2023-11-29
  https://linux.oracle.com/errata/ELSA-2023-7508.html
• Oracle Linux Security Advisory ELSA-2023-7500 vom 2023-11-29
  https://linux.oracle.com/errata/ELSA-2023-7500.html
• Red Hat Security Advisory RHSA-2023:7577 vom 2023-11-29
  https://access.redhat.com/errata/RHSA-2023:7577
• Red Hat Security Advisory RHSA-2023:7570 vom 2023-11-29
  https://access.redhat.com/errata/RHSA-2023:7570
• Red Hat Security Advisory RHSA-2023:7573 vom 2023-11-29
  https://access.redhat.com/errata/RHSA-2023:7573
• Red Hat Security Advisory RHSA-2023:7569 vom 2023-11-29
  https://access.redhat.com/errata/RHSA-2023:7569
• Red Hat Security Advisory RHSA-2023:7574 vom 2023-11-29
  https://access.redhat.com/errata/RHSA-2023:7574
• Debian Security Advisory DLA-3674 vom 2023-11-30
  https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html
• Ubuntu Security Notice USN-6509-2 vom 2023-12-04
  https://ubuntu.com/security/notices/USN-6509-2
• SUSE Security Update SUSE-SU-2023:4912-1 vom 2023-12-19
  https://lists.suse.com/pipermail/sle-security-updates/2023-December/017449.html
• SUSE Security Update SUSE-SU-2023:4929-1 vom 2023-12-20
  https://lists.suse.com/pipermail/sle-security-updates/2023-December/017505.html
• SUSE Security Update SUSE-SU-2023:4928-1 vom 2023-12-20
  https://lists.suse.com/pipermail/sle-security-updates/2023-December/017506.html
• Gentoo Linux Security Advisory GLSA-202401-10 vom 2024-01-07
  https://security.gentoo.org/glsa/202401-10
• Amazon Linux Security Advisory ALASFIREFOX-2024-019 vom 2024-01-09
  https://alas.aws.amazon.com/AL2/ALASFIREFOX-2024-019.html
• Amazon Linux Security Advisory ALAS-2024-2379 vom 2024-01-10
  https://alas.aws.amazon.com/AL2/ALAS-2024-2379.html
• IGEL Security Notice ISN-2024-03 vom 2024-01-31
  https://kb.igel.com/securitysafety/en/isn-2024-03-firefox-esr-vulnerabilities-112732506.html
• Gentoo Linux Security Advisory GLSA-202402-25 vom 2024-02-19
  https://security.gentoo.org/glsa/202402-25
• openSUSE Security Update OPENSUSE-SU-2024:14572-1 vom 2024-12-13
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V/