Skip to content
OpenAdvisories
Unscored CVE-2023-6211 EUVD-2023-58458GHSA-mv6j-qcrj-q856

If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked…

Published Nov 21, 2023 · Updated Feb 13, 2025 · Assigned by mozilla

Vendor: Mozilla Product: Firefox Package: firefox Package: mozjs102 Package: mozjs38 Package: mozjs52 Package: mozjs68 Package: mozjs78 Package: mozjs91 Category: Browsers Ecosystem: Ubuntu

Description

If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked the user into clicking to grant an HTTPS-only exception if they could get the user to participate in a clicking game. This vulnerability affects Firefox < 120.

Affected products

VendorProductAffectedFixed
Mozilla Firefox unspecified – < 120 120

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS mozjs102 No fix yet —
Ubuntu 22.04 LTS mozjs78 +2 No fix yet —
Ubuntu 20.04 LTS firefox 120.0+build2-0ubuntu0.20.04.1 USN-6509-1
Ubuntu 20.04 LTS mozjs52 +1 No fix yet —
Ubuntu 18.04 LTS mozjs38 +1 No fix yet —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaFirefox 120.0-1.1 openSUSE-SU-2024:13468-1
openSUSE Tumbleweed firefox-esr 128.5.1-1.1 openSUSE-SU-2024:14572-1

Advisories 4

References