USN-5954-1

Dashboard / Vulnerabilities / USN-5954-1

USN-5954-1

Summary: firefox vulnerabilities

Details: Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2023-25750, CVE-2023-25752, CVE-2023-28162, CVE-2023-28176, CVE-2023-28177) Lukas Bernhard discovered that Firefox did not properly manage memory when invalidating JIT code while following an iterator. An attacker could potentially exploits this issue to cause a denial of service. (CVE-2023-25751) Rob Wu discovered that Firefox did not properly manage the URLs when following a redirect to a publicly accessible web extension file. An attacker could potentially exploits this to obtain sensitive information. (CVE-2023-28160) Luan Herrera discovered that Firefox did not properly manage cross-origin iframe when dragging a URL. An attacker could potentially exploit this issue to perform spoofing attacks. (CVE-2023-28164) Khiem Tran discovered that Firefox did not properly manage one-time permissions granted to a document loaded using a file: URL. An attacker could potentially exploit this issue to use granted one-time permissions on the local files came from different sources. (CVE-2023-28161)

References: https://ubuntu.com/security/notices/USN-5954-1, https://ubuntu.com/security/CVE-2023-25750, https://ubuntu.com/security/CVE-2023-25751, https://ubuntu.com/security/CVE-2023-25752, https://ubuntu.com/security/CVE-2023-28160, https://ubuntu.com/security/CVE-2023-28161, https://ubuntu.com/security/CVE-2023-28162, https://ubuntu.com/security/CVE-2023-28164, https://ubuntu.com/security/CVE-2023-28176, https://ubuntu.com/security/CVE-2023-28177