CVE-2023-28161

If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, such as in a download directory. This vulnerability affects Firefox < 111.

These are all security issues fixed in the MozillaFirefox-111.0.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox fixes the following issues:

Update to version 102.9.0 ESR (bsc#1209173):

• CVE-2023-28159: Fullscreen Notification could have been hidden by download popups on Android
• CVE-2023-25748: Fullscreen Notification could have been hidden by window prompts on Android
• CVE-2023-25749: Firefox for Android may have opened third-party apps without a prompt
• CVE-2023-25750: Potential ServiceWorker cache leak during private browsing mode
• CVE-2023-25751: Incorrect code generation during JIT compilation
• CVE-2023-28160: Redirect to Web Extension files may have leaked local path
• CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation
• CVE-2023-28161: One-time permissions granted to a local file were extended to other local files loaded in the same tab
• CVE-2023-28162: Invalid downcast in Worklets
• CVE-2023-25752: Potential out-of-bounds when accessing throttled streams
• CVE-2023-28163: Windows Save As dialog resolved environment variables
• CVE-2023-28176: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9
• CVE-2023-28177: Memory safety bugs fixed in Firefox 111

This update for MozillaFirefox fixes the following issues:

Update to version 102.9.0 ESR (bsc#1209173):

• CVE-2023-28159: Fullscreen Notification could have been hidden by download popups on Android
• CVE-2023-25748: Fullscreen Notification could have been hidden by window prompts on Android
• CVE-2023-25749: Firefox for Android may have opened third-party apps without a prompt
• CVE-2023-25750: Potential ServiceWorker cache leak during private browsing mode
• CVE-2023-25751: Incorrect code generation during JIT compilation
• CVE-2023-28160: Redirect to Web Extension files may have leaked local path
• CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation
• CVE-2023-28161: One-time permissions granted to a local file were extended to other local files loaded in the same tab
• CVE-2023-28162: Invalid downcast in Worklets
• CVE-2023-25752: Potential out-of-bounds when accessing throttled streams
• CVE-2023-28163: Windows Save As dialog resolved environment variables
• CVE-2023-28176: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9
• CVE-2023-28177: Memory safety bugs fixed in Firefox 111

This update for MozillaFirefox fixes the following issues:

Update to version 102.9.0 ESR (bsc#1209173):

• CVE-2023-28159: Fullscreen Notification could have been hidden by download popups on Android
• CVE-2023-25748: Fullscreen Notification could have been hidden by window prompts on Android
• CVE-2023-25749: Firefox for Android may have opened third-party apps without a prompt
• CVE-2023-25750: Potential ServiceWorker cache leak during private browsing mode
• CVE-2023-25751: Incorrect code generation during JIT compilation
• CVE-2023-28160: Redirect to Web Extension files may have leaked local path
• CVE-2023-28164: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation
• CVE-2023-28161: One-time permissions granted to a local file were extended to other local files loaded in the same tab
• CVE-2023-28162: Invalid downcast in Worklets
• CVE-2023-25752: Potential out-of-bounds when accessing throttled streams
• CVE-2023-28163: Windows Save As dialog resolved environment variables
• CVE-2023-28176: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9
• CVE-2023-28177: Memory safety bugs fixed in Firefox 111

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2023-25750, CVE-2023-25752, CVE-2023-28162, CVE-2023-28176, CVE-2023-28177)

Lukas Bernhard discovered that Firefox did not properly manage memory when invalidating JIT code while following an iterator. An attacker could potentially exploits this issue to cause a denial of service. (CVE-2023-25751)

Rob Wu discovered that Firefox did not properly manage the URLs when following a redirect to a publicly accessible web extension file. An attacker could potentially exploits this to obtain sensitive information. (CVE-2023-28160)

Luan Herrera discovered that Firefox did not properly manage cross-origin iframe when dragging a URL. An attacker could potentially exploit this issue to perform spoofing attacks. (CVE-2023-28164)

Khiem Tran discovered that Firefox did not properly manage one-time permissions granted to a document loaded using a file: URL. An attacker could potentially exploit this issue to use granted one-time permissions on the local files came from different sources. (CVE-2023-28161)