CVE-2023-4056

Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 5 more

CVE-2023-4055

Mozilla: Cookie jar overflow caused unexpected cookie jar state

When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 5 more

CVE-2023-4050

Mozilla: Stack buffer overflow in StorageManager

In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash which could have led to a sandbox escape. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

CVSS 3.1 · 7.5 High EPSS 12.6% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 5 more

CVE-2023-4049

Mozilla: Fix potential race conditions when releasing platform objects

Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Enterprise Linux and 4 more

CVE-2023-4048

Mozilla: Crash in DOMParser due to out-of-memory conditions

An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 5 more

CVE-2023-4047

Mozilla: Potential permissions request bypass via clickjacking

A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Enterprise Linux and 4 more

CVE-2023-4046

Mozilla: Incorrect value used during WASM compilation

In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Enterprise Linux and 4 more

CVE-2023-40451

webkitgtk: attacker with JavaScript execution may be able to execute arbitrary code

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 17. An attacker with JavaScript execution may be able to execute arbitrary code.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Apple Redhat

Products

Safari Enterprise Linux Rhel Els

CVE-2023-4045

Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions

Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Enterprise Linux and 4 more

CVE-2023-40397

webkitgtk: arbitrary javascript code execution

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5. A remote attacker may be able to cause arbitrary javascript code execution.

CVSS 3.1 · 9.8 Critical EPSS 1.7% KEV · Not listed

Vendors

Apple Redhat Webkitgtk and 1 more

Products

Macos Enterprise Linux Rhel Aus and 6 more

CVE-2023-39326

Denial of service via chunk extensions in net/http

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Golang Redhat

Products

Go Ansible Automation Platform Cryostat and 17 more

CVE-2023-39325

HTTP/2 rapid reset can cause excessive work in net/http

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed

Vendors

Fedoraproject Golang Netapp and 1 more

Products

Fedora Go Http2 and 50 more

CVE-2023-39322

Memory exhaustion in QUIC connection handling in crypto/tls

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Go Standard Library Golang Redhat

Products

Crypto Tls Go Acm and 15 more

CVE-2023-39321

Panic when processing post-handshake message on QUIC connections in crypto/tls

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Ansible Automation Platform and 14 more

CVE-2023-39319

Improper handling of special tags within script contexts in html/template

The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Enterprise Linux and 12 more

CVE-2023-39318

Improper handling of HTML-like comments in script contexts in html/template

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Enterprise Linux and 12 more

CVE-2023-3863

Use-after-free in nfc_llcp_find_loca in net/nfc/llcp_core.c

A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel. This flaw allows a local user with special privileges to impact a kernel information leak issue.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux

CVE-2023-38611

webkitgtk: arbitrary code execution

The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. Processing web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 5 more

CVE-2023-38599

webkitgtk: track sensitive user information

A logic issue was addressed with improved state management. This issue is fixed in Safari 16.6, watchOS 9.6, iOS 15.7.8 and iPadOS 15.7.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A website may be able to track sensitive user information.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 5 more

CVE-2023-38597

webkitgtk: arbitrary code execution

The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5, Safari 16.6. Processing web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 3 more