- Vulnerability/
- USN-5954-1
USN-5954-1: Firefox vulnerabilities
First published: Wed Mar 15 2023(Updated: )
Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2023-25750, CVE-2023-25752, CVE-2023-28162, CVE-2023-28176, CVE-2023-28177) Lukas Bernhard discovered that Firefox did not properly manage memory when invalidating JIT code while following an iterator. An attacker could potentially exploits this issue to cause a denial of service. (CVE-2023-25751) Rob Wu discovered that Firefox did not properly manage the URLs when following a redirect to a publicly accessible web extension file. An attacker could potentially exploits this to obtain sensitive information. (CVE-2023-28160) Luan Herrera discovered that Firefox did not properly manage cross-origin iframe when dragging a URL. An attacker could potentially exploit this issue to perform spoofing attacks. (CVE-2023-28164) Khiem Tran discovered that Firefox did not properly manage one-time permissions granted to a document loaded using a file: URL. An attacker could potentially exploit this issue to use granted one-time permissions on the local files came from different sources. (CVE-2023-28161)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/firefox | <111.0+build2-0ubuntu0.20.04.1 | 111.0+build2-0ubuntu0.20.04.1 |
| Ubuntu Ubuntu | =20.04 | |
| All of | ||
| ubuntu/firefox | <111.0+build2-0ubuntu0.18.04.1 | 111.0+build2-0ubuntu0.18.04.1 |
| Ubuntu Ubuntu | =18.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2023-28176
- https://ubuntu.com/security/CVE-2023-28162
- https://ubuntu.com/security/CVE-2023-28161
- https://ubuntu.com/security/CVE-2023-25750
- https://ubuntu.com/security/CVE-2023-25751
- https://ubuntu.com/security/CVE-2023-28160
- https://ubuntu.com/security/CVE-2023-28164
- https://ubuntu.com/security/CVE-2023-28177
- https://ubuntu.com/security/CVE-2023-25752
- https://ubuntu.com/security/notices/USN-5972-1
- https://ubuntu.com/security/notices/USN-6120-1
- https://launchpad.net/ubuntu/+source/firefox/111.0+build2-0ubuntu0.20.04.1
- https://launchpad.net/ubuntu/+source/firefox/111.0+build2-0ubuntu0.18.04.1
- https://ubuntu.com/security/notices/USN-5954-1 (Advisory)
Child vulnerabilities
(Contains the following vulnerabilities)
Frequently Asked Questions
What is the severity of USN-5954-1?
The severity of USN-5954-1 is high.
How can an attacker exploit USN-5954-1?
An attacker can potentially exploit USN-5954-1 by tricking a user into opening a specially crafted website to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code.
Which software is affected by USN-5954-1?
The Firefox browser on Ubuntu 20.04 and 18.04 is affected by USN-5954-1.
How can I fix USN-5954-1?
To fix USN-5954-1, update Firefox to version 111.0+build2-0ubuntu0.20.04.1 on Ubuntu 20.04 or version 111.0+build2-0ubuntu0.18.04.1 on Ubuntu 18.04.
Where can I find more information about USN-5954-1?
More information about USN-5954-1 can be found on the following Ubuntu Security Notices: CVE-2023-28176, CVE-2023-28162, CVE-2023-28161.
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- collector/usn
- source/Ubuntu
- anchor-related/USN-5972-1
- anchor-related/USN-6120-1
- agent/software-canonical-lookup
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/20.04
- version/ubuntu ubuntu/18.04