CVE-2023-23597: Weak Encryption

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1538028
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-01/
• https://www.mozilla.org/security/advisories/mfsa2023-01/

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2023-01

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2023-23597
• CVE-2023-23598
• CVE-2023-23599
• CVE-2023-23600
• CVE-2023-23601
• CVE-2023-23602
• CVE-2023-23603
• CVE-2023-23604
• CVE-2023-23605
• CVE-2023-23606

Frequently Asked Questions

• What is CVE-2023-23597?

  CVE-2023-23597 is a vulnerability in Mozilla Firefox that allows a compromised web child process to disable web security opening restrictions and spawn a new child process within the file:// context, which can lead to arbitrary file read if exploited.

• How does CVE-2023-23597 affect Mozilla Firefox?

  CVE-2023-23597 affects Mozilla Firefox versions up to and excluding 109.0, allowing a compromised web child process to disable web security and spawn a new child process within the file:// context.

• What is the severity rating of CVE-2023-23597?

  CVE-2023-23597 has a severity rating of 6.5 out of 10 (high severity).

• How can CVE-2023-23597 be exploited?

  CVE-2023-23597 can be exploited by using a reliable exploit primitive to spawn a new child process within the file:// context, which can lead to arbitrary file read.

• Is there a fix available for CVE-2023-23597?

  Yes, Mozilla has released a fix for CVE-2023-23597. It is recommended to update to version 109.0 or later of Mozilla Firefox to mitigate the vulnerability.