Vulnerability

CERT-In Vulnerability Note CIVN-2023-0198
Multiple Vulnerabilities in Mozilla Products

Original Issue Date:July 12, 2023

Severity Rating: HIGH

Software Affected

Mozilla Firefox versions prior to 115
Mozilla Firefox ESR versions prior to 102.13
Mozilla Thunderbird versions prior to 102.13
Mozilla Firefox for iOS versions prior to 115
Mozilla Firefox and Firefox ESR versions prior to 115.0.2

Overview

Multiple vulnerabilities have been reported in Mozilla products which could be exploited by an attacker to perform spoofing attack, bypass security restrictions, obtain sensitive information, execute arbitrary code or cause denial of service condition on the targeted system.

Description

These vulnerabilities exist in Mozilla products due to a use-after-free in WebRTC, workers, Cross-compartment wrappers, NotifyOnHistoryReload ; the obscuring of the fullscreen notification ; insufficient validation in the Drag & Drop API or symlinks in the FileSystem API ; the use of RTL Arabic characters in the address bar ; lack of warning when opening Diagcab files ; preventing a user from exiting full-screen mode using alert and prompt calls ; memory safety bugs within the browser engine ; Media permission request prompt showing from background tab and improper validation in the session restoration. A remote attacker could exploit these vulnerabilities by convincing a victim to open a specially crafted web request.

Successful exploitation of these vulnerabilities could allow a remote attacker to perform spoofing attack, bypass security restrictions, obtain sensitive information, execute arbitrary code or cause denial of service condition on the targeted system.

Solution

Apply appropriate fixes issued by the vendor:

Upgrade to Mozilla Firefox version 115
Upgrade to Mozilla Firefox ESR version 102.13
Upgrade to Mozilla Thunderbird version 102.13
Upgrade to Mozilla Firefox for iOS version 115
Upgrade to Mozilla Firefox and Firefox ESR version 115.0.2

Vendor Information

Mozilla
https://www.mozilla.org/en-US/security/advisories/mfsa2023-22/
https://www.mozilla.org/en-US/security/advisories/mfsa2023-23/
https://www.mozilla.org/en-US/security/advisories/mfsa2023-24/
https://www.mozilla.org/en-US/security/advisories/mfsa2023-25/
https://www.mozilla.org/en-US/security/advisories/mfsa2023-26/

References

CVE Name
CVE-2023-3482
CVE-2023-37201
CVE-2023-37202
CVE-2023-37203
CVE-2023-37204
CVE-2023-37205
CVE-2023-37206
CVE-2023-37207
CVE-2023-37208
CVE-2023-37209
CVE-2023-37210
CVE-2023-37211
CVE-2023-37212
CVE-2023-37455
CVE-2023-37456
CVE-2023-3600

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India