Vulnerability-Lookup

alsa-2023:0808

Vulnerability from osv_almalinux

Published

2023-02-20 00:00

Modified

2023-02-21 17:34

Summary

Important: firefox security update

Details

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 102.8.0 ESR.

Security Fix(es):

Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767)
Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728)
Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)
Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735)
Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737)
Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)
Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743)
Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744)
Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)
Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729)
Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732)
Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2023:0808	ADVISORY
	https://access.redhat.com/security/cve/CVE-2023-0767	REPORT
	https://access.redhat.com/security/cve/CVE-2023-25728	REPORT
	https://access.redhat.com/security/cve/CVE-2023-25729	REPORT
	https://access.redhat.com/security/cve/CVE-2023-25730	REPORT
	https://access.redhat.com/security/cve/CVE-2023-25732	REPORT
	https://access.redhat.com/security/cve/CVE-2023-25735	REPORT
	https://access.redhat.com/security/cve/CVE-2023-25737	REPORT
	https://access.redhat.com/security/cve/CVE-2023-25739	REPORT
	https://access.redhat.com/security/cve/CVE-2023-25742	REPORT
	https://access.redhat.com/security/cve/CVE-2023-25743	REPORT
	https://access.redhat.com/security/cve/CVE-2023-25744	REPORT
	https://access.redhat.com/security/cve/CVE-2023-25746	REPORT
	https://bugzilla.redhat.com/2170374	REPORT
	https://bugzilla.redhat.com/2170375	REPORT
	https://bugzilla.redhat.com/2170376	REPORT
	https://bugzilla.redhat.com/2170377	REPORT
	https://bugzilla.redhat.com/2170378	REPORT
	https://bugzilla.redhat.com/2170379	REPORT
	https://bugzilla.redhat.com/2170381	REPORT
	https://bugzilla.redhat.com/2170382	REPORT
	https://bugzilla.redhat.com/2170383	REPORT
	https://bugzilla.redhat.com/2170390	REPORT
	https://bugzilla.redhat.com/2170391	REPORT
	https://bugzilla.redhat.com/2170402	REPORT
	https://errata.almalinux.org/8/ALSA-2023-0808.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "firefox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "102.8.0-2.el8_7.alma"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 102.8.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767)\n* Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728)\n* Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)\n* Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735)\n* Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737)\n* Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)\n* Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743)\n* Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744)\n* Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)\n* Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729)\n* Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732)\n* Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "ALSA-2023:0808",
  "modified": "2023-02-21T17:34:13Z",
  "published": "2023-02-20T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2023:0808"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2023-0767"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2023-25728"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2023-25729"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2023-25730"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2023-25732"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2023-25735"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2023-25737"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2023-25739"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2023-25742"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2023-25743"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2023-25744"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2023-25746"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2170374"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2170375"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2170376"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2170377"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2170378"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2170379"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2170381"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2170382"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2170383"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2170390"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2170391"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2170402"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2023-0808.html"
    }
  ],
  "related": [
    "CVE-2023-0767",
    "CVE-2023-25728",
    "CVE-2023-25730",
    "CVE-2023-25735",
    "CVE-2023-25737",
    "CVE-2023-25739",
    "CVE-2023-25743",
    "CVE-2023-25744",
    "CVE-2023-25746",
    "CVE-2023-25729",
    "CVE-2023-25732",
    "CVE-2023-25742"
  ],
  "summary": "Important: firefox security update"
}

CVE-2023-25744 (GCVE-0-2023-25744)

Vulnerability from cvelistv5 – Published: 2023-06-02 00:00 – Updated: 2025-01-09 16:11

Summary

Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 110 and Firefox ESR < 102.8.

Severity

No CVSS data available.

CWE

Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8

Assigner

mozilla

References

3 references

URL	Tags
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Affected: unspecified , < 110 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 102.8 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:32:11.855Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2023-06/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2023-05/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1789449%2C1803628%2C1810536"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-25744",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-09T16:10:45.458902Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-09T16:11:13.434Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "110",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 110 and Firefox ESR \u003c 102.8."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-02T00:00:00.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2023-06/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2023-05/"
        },
        {
          "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1789449%2C1803628%2C1810536"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2023-25744",
    "datePublished": "2023-06-02T00:00:00.000Z",
    "dateReserved": "2023-02-13T00:00:00.000Z",
    "dateUpdated": "2025-01-09T16:11:13.434Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-25746 (GCVE-0-2023-25746)

Vulnerability from cvelistv5 – Published: 2023-06-02 00:00 – Updated: 2025-01-09 19:15

Summary

Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 102.8 and Firefox ESR < 102.8.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Memory safety bugs fixed in Firefox ESR 102.8

Assigner

mozilla

References

3 references

URL	Tags
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Thunderbird	Affected: unspecified , < 102.8 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 102.8 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:32:12.688Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2023-06/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2023-07/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1544127%2C1762368"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-25746",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-09T19:10:21.834989Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-09T19:15:06.530Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 102.8 and Firefox ESR \u003c 102.8."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Memory safety bugs fixed in Firefox ESR 102.8",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-02T00:00:00.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2023-06/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2023-07/"
        },
        {
          "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1544127%2C1762368"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2023-25746",
    "datePublished": "2023-06-02T00:00:00.000Z",
    "dateReserved": "2023-02-13T00:00:00.000Z",
    "dateUpdated": "2025-01-09T19:15:06.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

alsa-2023:0808

Vulnerability from osv_almalinux

CVE-2023-25744 (GCVE-0-2023-25744)

CVE-2023-25746 (GCVE-0-2023-25746)

Tags

Sightings

Nomenclature