| Description: | Summary:
The remote host is missing an update for the 'firefox' package(s) announced via the USN-6320-1 advisory.
Vulnerability Insight:
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2023-4573,
CVE-2023-4574, CVE-2023-4575, CVE-2023-4578, CVE-2023-4581, CVE-2023-4583,
CVE-2023-4584, CVE-2023-4585)
Lukas Bernhard discovered that Firefox did not properly manage memory when
the 'UpdateRegExpStatics' attempted to access 'initialStringHeap'. An
attacker could potentially exploit this issue to cause a denial of service.
(CVE-2023-4577)
Malte Jurgens discovered that Firefox did not properly handle search
queries if the search query itself was a well formed URL. An attacker could
potentially exploit this issue to perform spoofing attacks. (CVE-2023-4579)
Harveer Singh discovered that Firefox did not properly handle push
notifications stored on disk in private browsing mode. An attacker could
potentially exploits this issue to access sensitive information.
(CVE-2023-4580)
Affected Software/OS:
'firefox' package(s) on Ubuntu 20.04.
Solution:
Please install the updated package(s).
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
