CVE-2023-5732: Address bar spoofing via bidirectional characters
An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 115.4 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.4.1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 115.15.0esr-1~deb11u1Fixed in 115.14.0esr-1~deb12u1Fixed in 115.15.0esr-1~deb12u1Fixed in 115.15.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:115.15.0-1~deb11u1Fixed in 1:115.12.0-1~deb12u1Fixed in 1:115.15.0-1~deb12u1Fixed in 1:128.1.1esr-1Fixed in 1:128.2.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.4.1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 117 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.4
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2023-5732?
CVE-2023-5732 is a vulnerability that allows an attacker to create a malicious link using bidirectional characters to spoof the location in the address bar.
What software is affected by CVE-2023-5732?
Mozilla Firefox ESR version up to 115.4 is affected by CVE-2023-5732.
How severe is CVE-2023-5732?
CVE-2023-5732 has a severity level of medium.
How can I fix CVE-2023-5732?
To fix CVE-2023-5732, update Mozilla Firefox ESR to version 115.4 or later.
Where can I find more information about CVE-2023-5732?
For more information about CVE-2023-5732, you can refer to the following references: [Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1690979) and [Mozilla Security Advisories](https://www.mozilla.org/en-US/security/advisories/mfsa2023-46/).