Risk | High |
Patch available | YES |
Number of vulnerabilities | 11 |
CVE-ID | CVE-2023-32205 CVE-2023-32206 CVE-2023-32207 CVE-2023-32208 CVE-2023-32209 CVE-2023-32210 CVE-2023-32211 CVE-2023-32212 CVE-2023-32213 CVE-2023-32215 CVE-2023-32216 |
CWE-ID | CWE-451 CWE-125 CWE-254 CWE-200 CWE-400 CWE-264 CWE-843 CWE-119 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Ubuntu Operating systems & Components / Operating system firefox (Ubuntu package) Operating systems & Components / Operating system package or component |
Vendor | Canonical Ltd. |
Security Bulletin
This security bulletin contains information about 11 vulnerabilities.
EUVDB-ID: #VU75874
Risk: Medium
CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-32205
CWE-ID:
CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data. A remote attacker can obscure browser prompts and perform spoofing attack.
Update the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 113.0+build2-0ubuntu0.20.04.1
CPE2.3 External linkshttp://ubuntu.com/security/notices/USN-6074-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU75875
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-32206
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition in the RLBox Expat driver. A remote attacker can trick the victim to open a specially crafted website, trigger an out-of-bounds read error and crash the browser.
Update the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 113.0+build2-0ubuntu0.20.04.1
CPE2.3 External linkshttp://ubuntu.com/security/notices/USN-6074-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU75876
Risk: Medium
CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-32207
CWE-ID:
CWE-254 - Security Features
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform clickjacking attack.
The vulnerability exists due to a missing delay in popup notifications. A remote attacker can trick a victim into granting permissions.
MitigationUpdate the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 113.0+build2-0ubuntu0.20.04.1
CPE2.3 External linkshttp://ubuntu.com/security/notices/USN-6074-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU75877
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-32208
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to Firefox leaks the script base URL in service workers due to dynamic import() call. A remote attacker can access to sensitive information.
MitigationUpdate the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 113.0+build2-0ubuntu0.20.04.1
CPE2.3 External linkshttp://ubuntu.com/security/notices/USN-6074-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU75878
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-32209
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing favicon image. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
MitigationUpdate the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 113.0+build2-0ubuntu0.20.04.1
CPE2.3 External linkshttp://ubuntu.com/security/notices/USN-6074-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU75879
Risk: Medium
CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-32210
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to documents incorrectly assume an ordering of principal objects. A remote attacker can cause a document to be loaded with a higher privileged principal than intended.
MitigationUpdate the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 113.0+build2-0ubuntu0.20.04.1
CPE2.3 External linkshttp://ubuntu.com/security/notices/USN-6074-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU75880
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-32211
CWE-ID:
CWE-843 - Type confusion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a type confusion error when processing HTML content. A remote attacker can trick the victim to open a specially crafted website, trigger a type confusion error and crash the browser.
Update the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 113.0+build2-0ubuntu0.20.04.1
CPE2.3 External linkshttp://ubuntu.com/security/notices/USN-6074-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU75881
Risk: Medium
CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-32212
CWE-ID:
CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data. A remote attacker can spoof the address bar using the datalist element.
Update the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 113.0+build2-0ubuntu0.20.04.1
CPE2.3 External linkshttp://ubuntu.com/security/notices/USN-6074-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU75882
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-32213
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within FileReader::DoReadData() when reading a file. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.
MitigationUpdate the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 113.0+build2-0ubuntu0.20.04.1
CPE2.3 External linkshttp://ubuntu.com/security/notices/USN-6074-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU75884
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-32215
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can trick the victim to open a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 113.0+build2-0ubuntu0.20.04.1
CPE2.3 External linkshttp://ubuntu.com/security/notices/USN-6074-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU75885
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-32216
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 113.0+build2-0ubuntu0.20.04.1
CPE2.3 External linkshttp://ubuntu.com/security/notices/USN-6074-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.