CVE-2023-3600

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions.

Security Fix(es):

When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata. This vulnerability affects Firefox < 103.(CVE-2022-36315)

When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the target URL had been subject to a redirect. This vulnerability affects Firefox < 103.(CVE-2022-36316)

An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was zero-length, the value was not written to an invalid memory address. This vulnerability affects Firefox < 104.(CVE-2022-38475)

Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited in Private Browsing Mode. This would not have persisted them in a state where they would run again, but it would have leaked Private Browsing Mode details to disk. This vulnerability affects Firefox < 107.(CVE-2022-45417)

If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certificate, and then deleted the exception, Firefox would have kept the connection alive, making it seem like the certificate was still trusted. This vulnerability affects Firefox < 107.(CVE-2022-45419)

Mozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 107. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108.(CVE-2022-46879)

Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 106. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.<br />Note: This advisory was added on December 13th, 2022 after discovering it was inadvertently left out of the original advisory. The fix was included in the original release of Firefox 107. This vulnerability affects Firefox < 107.(CVE-2022-46883)

Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox < 110.(CVE-2023-25731)

The return value from gfx::SourceSurfaceSkia::Map() wasn't being verified which could have potentially lead to a null pointer dereference. This vulnerability affects Firefox < 110.(CVE-2023-25733)

An invalid downcast from nsHTMLDocument to nsIContent could have lead to undefined behavior. This vulnerability affects Firefox < 110.(CVE-2023-25736)

Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode. This vulnerability affects Firefox < 111.(CVE-2023-25750)

When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking potentially sensitive information. This vulnerability affects Firefox < 111.(CVE-2023-28160)

Memory safety bugs present in Firefox 110. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 111.(CVE-2023-28177)

Multiple race conditions in the font initialization could have led to memory corruption…

During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash. This vulnerability affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird < 115.0.1.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 115.3.1 ESR.

Security Fix(es):

• firefox: use-after-free in workers (CVE-2023-3600)
• Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)
• Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)
• Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3 (CVE-2023-5176)
• libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 115.3.1.

Security Fix(es):

• firefox: use-after-free in workers (CVE-2023-3600)
• Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)
• Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)
• Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3 (CVE-2023-5176)
• libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Use-after-free in workers. (CVE-2023-3600)

File Extension Spoofing using the Text Direction Override Character. (CVE-2023-3417)

Offscreen Canvas could have bypassed cross-origin restrictions. (CVE-2023-4045)

Incorrect value used during WASM compilation. (CVE-2023-4046)

Potential permissions request bypass via clickjacking. (CVE-2023-4047)

Crash in DOMParser due to out-of-memory conditions. (CVE-2023-4048)

Fix potential race conditions when releasing platform objects. (CVE-2023-4049)

Stack buffer overflow in StorageManager. (CVE-2023-4050)

Cookie jar overflow caused unexpected cookie jar state. (CVE-2023-4055)

Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14. (CVE-2023-4056)

Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. (CVE-2023-4057)

Memory corruption in IPC CanvasTranslator. (CVE-2023-4573)

Memory corruption in IPC ColorPickerShownCallback. (CVE-2023-4574)

Memory corruption in IPC FilePickerShownCallback. (CVE-2023-4575)

Integer Overflow in RecordedSourceSurfaceCreation. (CVE-2023-4576)

Memory corruption in JIT UpdateRegExpStatics. (CVE-2023-4577)

Full screen notification obscured by file open dialog. (CVE-2023-4051)

Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception. (CVE-2023-4578)

Full screen notification obscured by external program. (CVE-2023-4053)

Push notifications saved to disk unencrypted. (CVE-2023-4580)

XLL file extensions were downloadable without warnings. (CVE-2023-4581)

Browsing Context potentially not cleared when closing Private Window. (CVE-2023-4583)

Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2. (CVE-2023-4584)

Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. (CVE-2023-4585)

Heap buffer overflow in libwebp. (CVE-2023-4863)

These are all security issues fixed in the MozillaFirefox-115.0.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 115.3.1.

Security Fix(es):

• firefox: use-after-free in workers (CVE-2023-3600)

• Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

• Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

• Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3 (CVE-2023-5176)

• libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 115.3.1.

Security Fix(es):

• firefox: use-after-free in workers (CVE-2023-3600)

• Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

• Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

• Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3 (CVE-2023-5176)

• libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for MozillaFirefox fixes the following issues:

Firefox was updated to version 115.0.2 ESR (bsc#1213230):

• CVE-2023-3600: Fixed Use-after-free in workers (bmo#1839703).

Bugfixes:

• Fixed a startup crash experienced by some Windows users by blocking instances of a malicious injected DLL (bmo#1841751).
• Fixed a bug with displaying a caret in the text editor on some websites (bmo#1840804).
• Fixed a bug with broken audio rendering on some websites (bmo#1841982).
• Fixed a bug with patternTransform translate using the wrong units (bmo#1840746).
• Fixed a crash affecting Windows 7 users related to the DLL blocklist.
• Fixed a startup crash for Windows users with Kingsoft Antivirus software installed (bmo#1837242).

This update for MozillaFirefox fixes the following issues:

Firefox Extended Support Release 115.0.2 ESR (MFSA 2023-26, bsc#1213230)

Security fixes:

• CVE-2023-3600: Fixed use-after-free in workers (bmo#1839703)

Other fixes:

• Fixed a startup crash experienced by some Windows users by blocking instances of a malicious injected DLL (bmo#1841751)
• Fixed a bug with displaying a caret in the text editor on some websites (bmo#1840804)
• Fixed a bug with broken audio rendering on some websites (bmo#1841982)
• Fixed a bug with patternTransform translate using the wrong units (bmo#1840746)
• Fixed a crash affecting Windows 7 users related to the DLL blocklist.

Firefox Extended Support Release 115.0.1 ESR

• Fixed a startup crash for Windows users with Kingsoft Antivirus software installed (bmo#1837242)

This update for MozillaFirefox fixes the following issues:

Firefox Extended Support Release 115.0.2 ESR (MFSA 2023-26, bsc#1213230)

Security fixes:

• CVE-2023-3600: Fixed use-after-free in workers (bmo#1839703)

Other fixes:

• Fixed a startup crash experienced by some Windows users by blocking instances of a malicious injected DLL (bmo#1841751)
• Fixed a bug with displaying a caret in the text editor on some websites (bmo#1840804)
• Fixed a bug with broken audio rendering on some websites (bmo#1841982)
• Fixed a bug with patternTransform translate using the wrong units (bmo#1840746)
• Fixed a crash affecting Windows 7 users related to the DLL blocklist.

Firefox Extended Support Release 115.0.1 ESR

• Fixed a startup crash for Windows users with Kingsoft Antivirus software installed (bmo#1837242)

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird was updated to version 115.0.1 (bsc#1212438):

• CVE-2023-3600: Fixed use-after-free in workers (bmo#1839703).
• CVE-2023-3417: Fixed File Extension Spoofing using the Text Direction Override Character (bmo#1835582).

Bugfixes:

• changed: Added Thunderbird Supernova branding to about:dialog (bmo#1842102)
• fixed: Message list was not updated when message was deleted from server outside of Thunderbird (bmo#1837041)
• fixed: Scrolling behaved unexpectedly when moving to next message unread message in another folder (bmo#1841711)
• fixed: Scrolling animation was unnecessarily used when switching or toggling the sort column in message list (bmo#1838522)
• fixed: Attempting to delete a message and then cancelling the action still marked the message as read (bmo#793353)
• fixed: Unified Toolbar could not be customized under certain tabs (bmo#1841480)
• fixed: Selecting a folder with one or more subfolders and pressing enter did not expand folder (bmo#1841200)
• fixed: Tooltips did not appear when hovering over folders (bmo#1839780)
• fixed: Deleting large amounts of messages from Trash folder consumed excessive time and memory (bmo#1833665)
• fixed: Message Summary header buttons were not keyboard accessible (bmo#1827199)
• fixed: 'New' button in Message Filters dialog was not keyboard accessible (bmo#1841477)
• fixed: Backing up secret keys from OpenPGP Key Manager dialog silently failed (bmo#1839415)
• fixed: Various visual and UX improvements (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)

A use-after-free was discovered in Firefox when handling workers. An attacker could potentially exploit this to cause a denial of service, or execute arbitrary code.

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing, or execute arbitrary code. (CVE-2023-4057, CVE-2023-4577, CVE-2023-4578, CVE-2023-4583, CVE-2023-4585, CVE-2023-5169, CVE-2023-5171, CVE-2023-5176)

Andrew McCreight discovered that Thunderbird did not properly manage during the worker lifecycle. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2023-3600)

Harveer Singh discovered that Thunderbird did not store push notifications in private browsing mode in encrypted form. An attacker could potentially exploit this issue to obtain sensitive information. (CVE-2023-4580)

Clément Lecigne discovered that Thunderbird did not properly manage memory when handling VP8 media stream. An attacker-controlled VP8 media stream could lead to a heap buffer overflow in the content process, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-5217)