CERT-In Vulnerability Note
CIVN-2023-0348
Multiple Vulnerabilities in Mozilla Products
Original Issue Date:November 23, 2023
Severity Rating: HIGH
Software Affected
- Mozilla Firefox ESR versions prior to 115.5.0
- Mozilla Firefox for IOS versions prior to 120
- Mozilla Firefox versions prior to 120
- Mozilla Thunderbird versions prior to 115.5
Overview
Multiple vulnerabilities have been reported in Mozilla products which could allow a remote attacker to perform data manipulation, Elevation of privilege, Denial of service, remote code execution, sensitive information disclosure and security restriction bypass on the targeted system.
Description
These vulnerabilities exist in Mozilla products due to Out-of-bound memory access in WebGL2 blitFramebuffer, Use after free in MessagePort::Entangled and ReadableByteStreamQueueEntry::Buffer, Clickjacking permission prompts using the fullscreen transition, Using Selection API would copy contents into X11 primary selection, Incorrect parsing of relative URLs starting with "///", Mixed-content resources not blocked in a javascript: pop-up, Clickjacking to load insecure pages in HTTPS-only mode, Memory safety bugs, Privilege escalation through <a [referrerpolicy]> in ReaderMode, HTML injection in %READER-BYLINE% of ReaderMode. A remote attacker could exploit these vulnerabilities by persuading a victim to visit a specially-crafted Web site.
Successful exploitation of these vulnerabilities could allow a remote attacker to perform data manipulation, Elevation of privilege, Denial of service, remote code execution, sensitive information disclosure and security restriction bypass on the targeted system.
Solution
Apply appropriate fixes issued by the vendor:
https://www.mozilla.org/en-US/security/advisories/mfsa2023-52/
https://www.mozilla.org/en-US/security/advisories/mfsa2023-51/
https://www.mozilla.org/en-US/security/advisories/mfsa2023-50/
https://www.mozilla.org/en-US/security/advisories/mfsa2023-49/
Vendor Information
Mozilla
https://www.mozilla.org/en-US/security/advisories/mfsa2023-52/
https://www.mozilla.org/en-US/security/advisories/mfsa2023-51/
https://www.mozilla.org/en-US/security/advisories/mfsa2023-50/
https://www.mozilla.org/en-US/security/advisories/mfsa2023-49/
References
Mozilla
https://www.mozilla.org/en-US/security/advisories/mfsa2023-52/
https://www.mozilla.org/en-US/security/advisories/mfsa2023-51/
https://www.mozilla.org/en-US/security/advisories/mfsa2023-50/
https://www.mozilla.org/en-US/security/advisories/mfsa2023-49/
CVE Name
CVE-2023-6204
CVE-2023-6205
CVE-2023-6206
CVE-2023-6207
CVE-2023-6208
CVE-2023-6209
CVE-2023-6210
CVE-2023-6211
CVE-2023-6212
CVE-2023-6213
CVE-2023-49060
CVE-2023-49061
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|