Rewterz Threat Advisory – Multiple Mozilla Firefox Vulnerabilities

Severity

High

Analysis Summary

CVE-2023-4585 CVSS:8.8

Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.

CVE-2023-4583 CVSS:6.5

Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by the failure to clear browsing context when closing private window. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions.

CVE-2023-4582 CVSS:8.8

Mozilla Firefox is vulnerable to a buffer overflow, caused by improper bounds checking by WebGL glGetProgramiv. By persuading a victim to visit a specially crafted Web site, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

CVE-2023-4581 CVSS:6.5

Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by Excel .xll add-in files being downloadable without warnings. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions.

CVE-2023-4580 CVSS:6.5

Mozilla Firefox could allow a remote attacker to obtain sensitive information, caused by the failure to encrypt push notifications stored on disk in private browsing mode. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to obtain sensitive information.

CVE-2023-4579 CVSS:6.5

Mozilla Firefox could allow a remote attacker to conduct spoofing attacks, caused by the formatting of persistent search terms as URLS. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to conduct a spoofing attack.

CVE-2023-4578 CVSS:6.5

Mozilla Firefox is vulnerable to a denial of service, caused by an out-of-memory exception in error reporting methods in SpiderMonkey. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to corrupt the stack and cause the browser to crash.

CVE-2023-4577 CVSS:6.5

Mozilla Firefox is vulnerable to a denial of service, caused by a memory corruption in JIT UpdateRegExpStatics. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to corrupt the stack and cause the browser to crash.

CVE-2023-4576 CVSS:8.8

Mozilla Firefox is vulnerable to a heap-based buffer overflow, caused by an integer overflow in RecordedSourceSurfaceCreation. By persuading a victim to visit a specially crafted Web site, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

CVE-2023-4575 CVSS:6.5

Mozilla Firefox is vulnerable to a denial of service, caused by a memory corruption in IPC FilePickerShownCallback. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to corrupt the stack and cause the browser to crash.

CVE-2023-4574 CVSS:6.5

Mozilla Firefox is vulnerable to a denial of service, caused by a memory corruption in IPC ColorPickerShownCallback. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to corrupt the stack and cause the browser to crash.

CVE-2023-4573 CVSS:6.5

Mozilla Firefox is vulnerable to a denial of service, caused by a memory corruption in IPC CanvasTranslator. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to corrupt the stack and cause the browser to crash.

CVE-2023-4584 CVSS:8.8

Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.

Impact

• Code Execution
• Denial of Service
• Security Bypass
• Information Disclosure
• Buffer Overflow

Indicators Of Compromise

CVE

• CVE-2023-4585
• CVE-2023-4583
• CVE-2023-4582
• CVE-2023-4581
• CVE-2023-4580
• CVE-2023-4579
• CVE-2023-4578
• CVE-2023-4577
• CVE-2023-4576
• CVE-2023-4575
• CVE-2023-4574
• CVE-2023-4573
• CVE-2023-4584

Affected Vendors

Mozilla

Affected Products

• Mozilla Firefox 116
• Mozilla Firefox ESR 115.1
• Mozilla Firefox ESR 102.14

Remediation

Refer to Mozilla Foundation Security Advisory for patch, upgrade or suggested workaround information.

Mozilla Firefox 117

Mozilla Firefox ESR 115.2