PT-2023-1692 · Mozilla+10 · Firefox Esr+12

Goras Francesco · Publicado 2023-02-14 · Atualizado 2024-12-12 · CVE-2023-25742

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 110 Mozilla Firefox ESR versions prior to 102.8 Mozilla Thunderbird versions prior to 102.8

Description The issue is related to errors when importing a SPKI RSA public key as ECDSA P-256. This can cause a tab to crash when exploited by a remote attacker.

Recommendations For Mozilla Firefox versions prior to 110, update to version 110 or later. For Mozilla Firefox ESR versions prior to 102.8, update to version 102.8 or later. For Mozilla Thunderbird versions prior to 102.8, update to version 102.8 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-173

Identificadores relacionados

ALSA-2023:0808

ALSA-2023:0810

ALSA-2023:0821

ALSA-2023:0824

ALT-PU-2023-1374

ALT-PU-2023-1386

ALT-PU-2023-1387

ALT-PU-2023-1411

ALT-PU-2023-1435

ALT-PU-2023-1478

ALT-PU-2023-1758

ALT-PU-2023-1765

ALT-PU-2023-4365

ALT-PU-2023-4366

ALT-PU-2023-5754

ALT-PU-2024-3614

BDU:2023-01263

CESA-2023_0808

CESA-2023_0812

CESA-2023_0817

CESA-2023_0821

CVE-2023-25742

DLA-3319-1

DLA-3324-1

DSA-5350-1

DSA-5355-1

MGASA-2023-0056

MGASA-2023-0057

OESA-2023-1673

OESA-2023-1674

OPENSUSE-SU-2023_0461-1

OPENSUSE-SU-2024:12702-1

OPENSUSE-SU-2024:12713-1

OPENSUSE-SU-2024:12753-1

OPENSUSE-SU-2024:14572-1

RHSA-2023:0805

RHSA-2023:0806

RHSA-2023:0807

RHSA-2023:0808

RHSA-2023:0809

RHSA-2023:0810

RHSA-2023:0811

RHSA-2023:0812

RHSA-2023:0817

RHSA-2023:0818

RHSA-2023:0819

RHSA-2023:0820

RHSA-2023:0821

RHSA-2023:0822

RHSA-2023:0823

RHSA-2023:0824

RHSA-2023_0808

RHSA-2023_0810

RHSA-2023_0812

RHSA-2023_0817

RHSA-2023_0821

RHSA-2023_0824

RLSA-2023:0808

RLSA-2023:0810

RLSA-2023:0821

RLSA-2023:0824

SUSE-SU-2023:0461-1

SUSE-SU-2023:0466-1

SUSE-SU-2023:0469-1

SUSE-SU-2023:0599-1

USN-5880-1

USN-5880-2

USN-5943-1

Produtos afetados

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Firefox

Firefox Esr

Thunderbird

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Referências · 2295

• 🔥 https://github.com/mistymntncop/CVE-2023-4863 · Exploit
• 🔥 https://github.com/LiveOverflow/webp-CVE-2023-4863 · Exploit
• 🔥 https://github.com/UT-Security/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/wrv/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/bbaranoff/CVE-2023-4863 · Exploit
• https://access.redhat.com/security/cve/CVE-2023-25746 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-46882 · Nota de Segurança
• https://suse.com/security/cve/CVE-2023-25728 · Nota
• https://suse.com/security/cve/CVE-2022-31743 · Nota
• https://suse.com/security/cve/CVE-2018-12392 · Nota
• https://suse.com/security/cve/CVE-2024-5698 · Nota
• https://suse.com/security/cve/CVE-2013-1701 · Nota
• https://bugzilla.suse.com/1208144 · Nota
• https://suse.com/security/cve/CVE-2024-5687 · Nota
• https://mozilla.org/en-US/security/advisories/mfsa2023-06/#CVE-2023-25742 · Aviso do Fabricante