Oracle Linux: CVE-2023-25735: ELSA-2023-0810: firefox security update (IMPORTANT) (Multiple Advisories)

Oracle Linux: CVE-2023-25735: ELSA-2023-0810:firefox security update (IMPORTANT) (Multiple Advisories)

Severity

10

CVSS

(AV:N/AC:L/Au:N/C:C/I:C/A:C)

Published

02/14/2023

Created

02/22/2023

Added

02/21/2023

Modified

01/07/2025

Description

Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. The Mozilla Foundation Security Advisory describes this flaw as: Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy.

Solution(s)

• oracle-linux-upgrade-firefox
• oracle-linux-upgrade-firefox-x11
• oracle-linux-upgrade-thunderbird

References

• https://attackerkb.com/topics/cve-2023-25735
• CVE - 2023-25735
• ELSA-2023-0810
• ELSA-2023-0808
• ELSA-2023-0821
• ELSA-2023-0812
• ELSA-2023-0824
• ELSA-2023-0817

View more