• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – CVE-2023-20010 – Cisco Unified Communications Manager Vulnerability
January 19, 2023
Rewterz Threat Advisory – CVE-2022-47990 – IBM AIX Vulnerability
January 19, 2023

Rewterz Threat Advisory – Multiple Mozilla Firefox Vulnerabilities

January 19, 2023

Severity

Medium

Analysis Summary

CVE-2023-23606 CVSS:8.8

Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.

CVE-2023-23604 CVSS:6.5

Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by the failure to account for external URLs by regular expressions used to filter out forbidden properties and values from style directives in calls to console.log. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to exfiltrate data from the browser.

CVE-2023-23603 CVSS:6.5

Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by the failure to correctly apply Content Security Policy to WebSockets in WebWorkers. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to lead to connections to restricted origins from inside WebWorkers.

CVE-2023-23602 CVSS:6.5

Mozilla Firefox could allow a remote attacker to conduct spoofing attacks, caused by navigations being allowed when dragging a URL from a cross-origin iframe into the same tab. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to conduct spoofing attacks.

CVE-2023-23601 CVSS:6.5

Mozilla Firefox could allow a remote attacker to conduct spoofing attacks, caused by navigations being allowed when dragging a URL from a cross-origin iframe into the same tab. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to conduct spoofing attacks.

CVE-2023-23600 CVSS:6.5

Mozilla Firefox could allow a remote attacker to obtain sensitive information, caused by the incorrect storing of origin notification permissions. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to display notifications during different browsing sessions.

CVE-2023-23599 CVSS:6.5

Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by the improper validation of output when copying a network request from the developer tools panel as a curl command. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to allow arbitrary commands to be hidden within.

CVE-2023-23597 CVSS:6.5

Mozilla Firefox could allow a remote attacker to obtain sensitive information, caused by a logic bug in process allocation. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to read arbitrary files on the system.

CVE-2023-23598 CVSS:6.5

Mozilla Firefox could allow a remote attacker to obtain sensitive information, caused by the use of text/plain for a GTK drag and drop on Linux. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability using a call to DataTransfer.setData to read arbitrary files on the system.

CVE-2023-23605 CVSS:8.8

Mozilla Firefox could allow a remote attacker to obtain sensitive information, caused by the use of text/plain for a GTK drag and drop on Linux. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability using a call to DataTransfer.setData to read arbitrary files on the system.

Impact

  • Code Execution
  • Security Bypass
  • Gain Access
  • Information Disclosure

Indicators Of Compromise

CVE

  • CVE-2023-23606
  • CVE-2023-23604
  • CVE-2023-23603
  • CVE-2023-23602
  • CVE-2023-23601
  • CVE-2023-23600
  • CVE-2023-23599
  • CVE-2023-23597
  • CVE-2023-23598
  • CVE-2023-23605

Affected Vendors

Mozilla

Affected Products

  • Mozilla Firefox 108
  • Mozilla Firefox ESR 102.6

Remediation

Refer to Mozilla Foundation Security Advisory for patch, upgrade or suggested workaround information.

Mozilla Firefox 109

Mozilla Firefox ESR 102.7

  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.