CVE-2023-4583 — Browsing Context potentially not cleared when closing Private Window

Affected: Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird

When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.

USN-6320-1 — firefox vulnerabilities

Affected: Ubuntu:20.04:LTS: firefox

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2023-4573, CVE-2023-4574, CVE-2023-4575, CVE-2023-4578, CVE-2023-4581, CVE-2023-4583, CVE-2023-4584, CVE-2023-4585)

Lukas Bernhard discovered that Firefox did not properly manage memory when the "UpdateRegExpStatics" attempted to access "initialStringHeap". An attacker could potentially exploit this issue to cause a denial of service. (CVE-2023-4577)

Malte Jürgens discovered that Firefox did not properly handle search queries if the search query itself was a well formed URL. An attacker could potentially exploit this issue to perform spoofing attacks. (CVE-2023-4579)

Harveer Singh discovered that Firefox did not properly handle push notifications stored on disk in private browsing mode. An attacker could potentially exploits this issue to access sensitive information. (CVE-2023-4580)

Most recent entries from all

CVE-2023-4583 — Browsing Context potentially not cleared when closing Private Window

USN-6320-1 — firefox vulnerabilities