PT-2023-1317 · Mozilla+2 · Firefox For Android+2

Kazuki Nomoto · Published 2023-01-17 · Updated 2024-12-12 · CVE-2023-23600

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 109

Description The issue arises from the way per origin notification permissions were stored, failing to account for the browsing context in which the permission was granted. This could lead to notifications being displayed during different browsing sessions. The problem is specific to Firefox for Android, with other operating systems being unaffected.

Recommendations For Firefox for Android versions prior to 109, update to version 109 or later to resolve the issue. As a temporary workaround, consider restricting notification permissions to minimize the risk of unauthorized access.

Fix

Weakness Enumeration

CWE-371

Related Identifiers

ALT-PU-2023-1084

ALT-PU-2023-1478

BDU:2023-00603

CVE-2023-23600

OPENSUSE-SU-2024:12623-1

OPENSUSE-SU-2024:14572-1

Affected Products

Alt Linux

Astra Linux

Firefox For Android

References · 1871

• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12623-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2023-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23600 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23600 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00603 · Security Note
• https://mozilla.org/security/advisories/mfsa2023-01 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1787034 · Vendor Advisory
• https://suse.com/security/cve/CVE-2012-0442 · Note
• https://suse.com/security/cve/CVE-2012-1958 · Note
• https://suse.com/security/cve/CVE-2023-25728 · Note
• https://suse.com/security/cve/CVE-2022-31743 · Note
• https://suse.com/security/cve/CVE-2018-12392 · Note
• https://suse.com/security/cve/CVE-2024-5698 · Note
• https://suse.com/security/cve/CVE-2013-1701 · Note