Most recent entries from all

ALSA-2023:3587 — Important: thunderbird security update

Affected: AlmaLinux:9: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.12.0.

Security Fix(es):

* Mozilla: Click-jacking certificate exceptions through rendering lag (CVE-2023-34414) * Mozilla: Memory safety bugs fixed in Firefox 114 and Firefox ESR 102.12 (CVE-2023-34416)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-03196

certfr-2023-avi-0438 — De multiples vulnérabilités ont été découvertes dans Mozilla Firefox et Firefox ESR. Elles…

certfr-2023-avi-0438

EUVD-2026-216551

fkie_cve-2023-34414

The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user clicks in precise locations immediately before navigating to a site with a certificate error and made the renderer extremely busy at the same time, it could create a gap between when the error page was loaded and when the display actually refreshed. With the right timing the elicited clicks could land in that gap and activate the button that overrides the certificate error for that site. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12.

GHSA-75j9-5hgg-gprr

gsd-2023-34414

OESA-2026-3213 — mozjs102 security update

Affected: openEuler:24.03-LTS-SP1: mozjs102

SpiderMonkey is the code-name for Mozilla Firefox&apos;s C++ implementation of JavaScript. It is intended to be embedded in other applications that provide host environments for JavaScript. Security Fix(es):

Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 102.10 and Firefox ESR < 102.10.(CVE-2023-1945)

There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.(CVE-2023-1999)

A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.(CVE-2023-29533)

Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability affects…

openSUSE-SU-2024:12990-1 — MozillaThunderbird-102.12.0-1.1 on GA media

MozillaThunderbird-102.12.0-1.1 on GA media

RHSA-2023:3560 — Red Hat Security Advisory: firefox security update

Mozilla: Click-jacking certificate exceptions through rendering lag Mozilla: Memory safety bugs fixed in Firefox 114 and Firefox ESR 102.12

SUSE-SU-2023:2440-1 — Security update for MozillaFirefox

Security update for MozillaFirefox

UBUNTU-CVE-2023-34414

Affected: Ubuntu:20.04:LTS: firefox, Ubuntu:20.04:LTS: thunderbird, Ubuntu:22.04:LTS: thunderbird

WID-SEC-W-2023-1385 — Mozilla Firefox: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox und Mozilla Firefox ESR, ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Code auszuführen.