CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25729 – Mozilla: Extensions could have opened external schemes without user knowledge
https://notcve.org/view.php?id=CVE-2023-25729
Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to open them without user interaction via <code>ExpandedPrincipals</code>. This could lead to further malicious actions such as downloading files or interacting with software already installed on the system. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. The Mozilla Foundation Security Advisory describes this flaw as: Permission prompts for opening external schemes were only shown for `ContentPrincipals` resulting in extensions being able to open them without user interaction via `ExpandedPrincipals`. This could lead to further malicious actions such as downloading files or interacting with software already installed on the system. • https://bugzilla.mozilla.org/show_bug.cgi?id=1792138 https://www.mozilla.org/security/advisories/mfsa2023-05 https://www.mozilla.org/security/advisories/mfsa2023-06 https://www.mozilla.org/security/advisories/mfsa2023-07 https://access.redhat.com/security/cve/CVE-2023-25729 https://bugzilla.redhat.com/show_bug.cgi?id=2170382 • CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25730 – Mozilla: Screen hijack via browser fullscreen mode
https://notcve.org/view.php?id=CVE-2023-25730
A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. The Mozilla Foundation Security Advisory describes this flaw as: A background script invoking `requestFullscreen` and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks. • https://bugzilla.mozilla.org/show_bug.cgi?id=1794622 https://www.mozilla.org/security/advisories/mfsa2023-05 https://www.mozilla.org/security/advisories/mfsa2023-06 https://www.mozilla.org/security/advisories/mfsa2023-07 https://access.redhat.com/security/cve/CVE-2023-25730 https://bugzilla.redhat.com/show_bug.cgi?id=2170375 • CWE-821: Incorrect Synchronization •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25732 – Mozilla: Out of bounds memory write from EncodeInputStream
https://notcve.org/view.php?id=CVE-2023-25732
When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated potentially leading to an out of bounds memory write. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. The Mozilla Foundation Security Advisory describes this flaw as: When encoding data from an `inputStream` in `xpcom` the size of the input being encoded was not correctly calculated potentially leading to an out of bounds memory write. • https://bugzilla.mozilla.org/show_bug.cgi?id=1804564 https://www.mozilla.org/security/advisories/mfsa2023-05 https://www.mozilla.org/security/advisories/mfsa2023-06 https://www.mozilla.org/security/advisories/mfsa2023-07 https://access.redhat.com/security/cve/CVE-2023-25732 https://bugzilla.redhat.com/show_bug.cgi?id=2170383 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25735 – Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey
https://notcve.org/view.php?id=CVE-2023-25735
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. The Mozilla Foundation Security Advisory describes this flaw as: Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy. • https://bugzilla.mozilla.org/show_bug.cgi?id=1810711 https://www.mozilla.org/security/advisories/mfsa2023-05 https://www.mozilla.org/security/advisories/mfsa2023-06 https://www.mozilla.org/security/advisories/mfsa2023-07 https://access.redhat.com/security/cve/CVE-2023-25735 https://bugzilla.redhat.com/show_bug.cgi?id=2170378 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25737 – Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry
https://notcve.org/view.php?id=CVE-2023-25737
An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. The Mozilla Foundation Security Advisory describes this flaw as: An invalid downcast from `nsTextNode` to `SVGElement` could have lead to undefined behavior. • https://bugzilla.mozilla.org/show_bug.cgi?id=1811464 https://www.mozilla.org/security/advisories/mfsa2023-05 https://www.mozilla.org/security/advisories/mfsa2023-06 https://www.mozilla.org/security/advisories/mfsa2023-07 https://access.redhat.com/security/cve/CVE-2023-25737 https://bugzilla.redhat.com/show_bug.cgi?id=2170379 • CWE-704: Incorrect Type Conversion or Cast •