USN-5816-2: Firefox regressions<\/p>\n
USN-5816-1 fixed vulnerabilities in Firefox. The update introduced
\nseveral minor regressions. This update fixes the problem.<\/p>\n
We apologize for the inconvenience.<\/p>\n
Original advisory details:<\/p>\n
Niklas Baumstark discovered that a compromised web child process of Firefox
\n could disable web security opening restrictions, leading to a new child
\n process being spawned within the file:\/\/ context. An attacker could
\n potentially exploits this to obtain sensitive information. (CVE-2023-23597)<\/p>\n
Tom Schuster discovered that Firefox was not performing a validation check
\n on GTK drag data. An attacker could potentially exploits this to obtain
\n sensitive information. (CVE-2023-23598)<\/p>\n
Vadim discovered that Firefox was not properly sanitizing a curl command
\n output when copying a network request from the developer tools panel. An
\n attacker could potentially exploits this to hide and execute arbitrary
\n commands. (CVE-2023-23599)<\/p>\n
Luan Herrera discovered that Firefox was not stopping navigation when
\n dragging a URL from a cross-origin iframe into the same tab. An attacker
\n potentially exploits this to spoof the user. (CVE-2023-23601)<\/p>\n
Dave Vandyke discovered that Firefox did not properly implement CSP policy
\n when creating a WebSocket in a WebWorker. An attacker who was able to
\n inject markup into a page otherwise protected by a Content Security Policy
\n may have been able to inject an executable script. (CVE-2023-23602)<\/p>\n
Dan Veditz discovered that Firefox did not properly implement CSP policy
\n on regular expression when using console.log. An attacker potentially
\n exploits this to exfiltrate data from the browser. (CVE-2023-23603)<\/p>\n
Nika Layzell discovered that Firefox was not performing a validation check
\n when parsing a non-system html document via DOMParser::ParseFromSafeString.
\n An attacker potentially exploits this to bypass web security checks.
\n (CVE-2023-23604)<\/p>\n
Multiple security issues were discovered in Firefox. If a user were USN-5816-2: Firefox regressions USN-5816-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Niklas Baumstark discovered that a compromised web child process of Firefox could disable web security opening restrictions, leading to a new child process being spawned within the file:\/\/ context. An attacker could potentially exploits this to obtain sensitive information. (CVE-2023-23597) Tom Schuster discovered that Firefox was not performing a validation check on GTK drag data. An attacker could potentially exploits this to obtain sensitive information. (CVE-2023-23598) Vadim discovered that Firefox was not properly sanitizing a curl command output when copying a network request from the developer tools panel. An attacker could potentially exploits this to hide and execute arbitrary commands. (CVE-2023-23599) Luan Herrera discovered that Firefox was not stopping navigation when dragging a [ more… ]<\/a><\/p>\n<\/div>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[586],"tags":[587],"class_list":["post-49921","post","type-post","status-publish","format-standard","hentry","category-ubuntu-usn","tag-ubuntu-usn"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts\/49921","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/comments?post=49921"}],"version-history":[{"count":1,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts\/49921\/revisions"}],"predecessor-version":[{"id":49922,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts\/49921\/revisions\/49922"}],"wp:attachment":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/media?parent=49921"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/categories?post=49921"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/tags?post=49921"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n tricked into opening a specially crafted website, an attacker could
\n potentially exploit these to cause a denial of service, obtain sensitive
\n information across domains, or execute arbitrary code. (CVE-2023-23605,
\n CVE-2023-23606)
\nSource: USN-5816-2: Firefox regressions<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"