CVE-2023-5169

Un proceso de contenido comprometido podría haber proporcionado datos maliciosos en un `PathRecording`, lo que habría resultado en una escritura fuera de los límites, lo que habría provocado una falla potencialmente explotable en un proceso privilegiado. Esta vulnerabilidad afecta a Firefox < 118, Firefox ESR < 115.3 y Thunderbird < 115.3.

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: A compromised content process could have provided malicious data in a `PathRecording`, resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. Ronald Crane discovered that Firefox did not properly manage memory when non-HTTPS Alternate Services is enabled. An attacker could potentially exploit this issue to cause a denial of service.