Quote
<div class="ipsQuote_contents">
<h2>
<strong>Security Vulnerabilities fixed in Firefox ESR 102.10</strong>
</h2>
<dl><dt>
Announced April 11, 2023
</dt>
<dt>
Impact<span> high</span>
</dt>
<dt>
Products Firefox ESR
</dt>
<dt>
Fixed in
</dt>
<dd>
<ul><li>
Firefox ESR 102.10
</li>
</ul></dd>
</dl><h4>
<a href="https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29531" rel="external nofollow"><span>#</span>CVE-2023-29531: Out-of-bound memory access in WebGL on macOS</a>
</h4>
<dl><dt>
Reporter DoHyun Lee
</dt>
<dt>
Impact<span> high</span>
</dt>
</dl><h5>
<strong>Description</strong>
</h5>
<p>
An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash.
This bug only affects Firefox for macOS. Other operating systems are unaffected.
<h5>
<strong>References</strong>
</h5>
<ul><li>
<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1794292" rel="external nofollow">Bug 1794292</a>
</li>
</ul><h4>
<a href="https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29532" rel="external nofollow"><span>#</span>CVE-2023-29532: Mozilla Maintenance Service Write-lock bypass</a>
</h4>
<dl><dt>
Reporter Holger Fuhrmannek
</dt>
<dt>
Impact<span> high</span>
</dt>
</dl><h5>
<strong>Description</strong>
</h5>
<p>
A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server.
Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.
<h5>
<strong>References</strong>
</h5>
<ul><li>
<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1806394" rel="external nofollow">Bug 1806394</a>
</li>
</ul><h4>
<a href="https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29533" rel="external nofollow"><span>#</span>CVE-2023-29533: Fullscreen notification obscured</a>
</h4>
<dl><dt>
Reporter Irvan Kurniawan
</dt>
<dt>
Impact<span> high</span>
</dt>
</dl><h5>
<strong>Description</strong>
</h5>
<p>
A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls. This could have led to user confusion and possible spoofing attacks.
</p>
<h5>
<strong>References</strong>
</h5>
<ul><li>
<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1814597" rel="external nofollow">Bug 1814597</a>
</li>
<li>
<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1798219" rel="external nofollow">Bug 1798219</a>
</li>
</ul><h4>
<a href="https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1999" rel="external nofollow"><span>#</span>CVE-2023-1999: Double-free in libwebp</a>
</h4>
<dl><dt>
Reporter Irvan Kurniawan
</dt>
<dt>
Impact<span> high</span>
</dt>
</dl><h5>
<strong>Description</strong>
</h5>
<p>
A double-free in libwebp could have led to memory corruption and a potentially exploitable crash.
</p>
<h5>
<strong>References</strong>
</h5>
<ul><li>
<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1819244" rel="external nofollow">Bug 1819244</a>
</li>
</ul><h4>
<a href="https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29535" rel="external nofollow"><span>#</span>CVE-2023-29535: Potential Memory Corruption following Garbage Collector compaction</a>
</h4>
<dl><dt>
Reporter Lukas Bernhard
</dt>
<dt>
Impact<span> high</span>
</dt>
</dl><h5>
<strong>Description</strong>
</h5>
<p>
Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash.
</p>
<h5>
<strong>References</strong>
</h5>
<ul><li>
<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1820543" rel="external nofollow">Bug 1820543</a>
</li>
</ul><h4>
<a href="https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29536" rel="external nofollow"><span>#</span>CVE-2023-29536: Invalid free from JavaScript code</a>
</h4>
<dl><dt>
Reporter zx from qriousec
</dt>
<dt>
Impact<span> high</span>
</dt>
</dl><h5>
<strong>Description</strong>
</h5>
<p>
An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.
</p>
<h5>
<strong>References</strong>
</h5>
<ul><li>
<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1821959" rel="external nofollow">Bug 1821959</a>
</li>
</ul><h4>
<a href="https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29539" rel="external nofollow"><span>#</span>CVE-2023-29539: Content-Disposition filename truncation leads to Reflected File Download</a>
</h4>
<dl><dt>
Reporter Trung Pham
</dt>
<dt>
Impact<span> moderate</span>
</dt>
</dl><h5>
<strong>Description</strong>
</h5>
<p>
When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware.
</p>
<h5>
<strong>References</strong>
</h5>
<ul><li>
<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1784348" rel="external nofollow">Bug 1784348</a>
</li>
</ul><h4>
<a href="https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29541" rel="external nofollow"><span>#</span>CVE-2023-29541: Files with malicious extensions could have been downloaded unsafely on Linux</a>
</h4>
<dl><dt>
Reporter Ameen Basha M K
</dt>
<dt>
Impact<span> moderate</span>
</dt>
</dl><h5>
<strong>Description</strong>
</h5>
<p>
Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands.
This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.
<h5>
<strong>References</strong>
</h5>
<ul><li>
<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1810191" rel="external nofollow">Bug 1810191</a>
</li>
</ul><h4>
<a href="https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29542" rel="external nofollow"><span>#</span>CVE-2023-29542: Bypass of file download extension restrictions</a>
</h4>
<dl><dt>
Reporter Shaheen Fazim and Ameen Basha M K
</dt>
<dt>
Impact<span> moderate</span>
</dt>
</dl><h5>
<strong>Description</strong>
</h5>
<p>
A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code.
This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.
<h5>
<strong>References</strong>
</h5>
<ul><li>
<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1815062" rel="external nofollow">Bug 1815062</a>
</li>
<li>
<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1810793" rel="external nofollow">Bug 1810793</a>
</li>
</ul><h4>
<a href="https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29545" rel="external nofollow"><span>#</span>CVE-2023-29545: Windows Save As dialog resolved environment variables</a>
</h4>
<dl><dt>
Reporter Axel Chong (@Haxatron)
</dt>
<dt>
Impact<span> moderate</span>
</dt>
</dl><h5>
<strong>Description</strong>
</h5>
<p>
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user.
This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.
<h5>
<strong>References</strong>
</h5>
<ul><li>
<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1823077" rel="external nofollow">Bug 1823077</a>
</li>
</ul><h4>
<a href="https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-1945" rel="external nofollow"><span>#</span>CVE-2023-1945: Memory Corruption in Safe Browsing Code</a>
</h4>
<dl><dt>
Reporter Gabriele Svelto
</dt>
<dt>
Impact<span> moderate</span>
</dt>
</dl><h5>
<strong>Description</strong>
</h5>
<p>
Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.
</p>
<h5>
<strong>References</strong>
</h5>
<ul><li>
<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1777588" rel="external nofollow">Bug 1777588</a>
</li>
</ul><h4>
<a href="https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29548" rel="external nofollow"><span>#</span>CVE-2023-29548: Incorrect optimization result on ARM64</a>
</h4>
<dl><dt>
Reporter JunYoung Park
</dt>
<dt>
Impact<span> low</span>
</dt>
</dl><h5>
<strong>Description</strong>
</h5>
<p>
A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.
</p>
<h5>
<strong>References</strong>
</h5>
<ul><li>
<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1822754" rel="external nofollow">Bug 1822754</a>
</li>
</ul><h4>
<a href="https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/#CVE-2023-29550" rel="external nofollow"><span>#</span>CVE-2023-29550: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10</a>
</h4>
<dl><dt>
Reporter Mozilla developers and community
</dt>
<dt>
Impact<span> high</span>
</dt>
</dl><h5>
<strong>Description</strong>
</h5>
<p>
Mozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
</p>
<h5>
<strong>References</strong>
</h5>
<ul><li>
<a href="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1720594%2C1751945%2C1812498%2C1814217%2C1818357%2C1818762%2C1819493%2C1820389%2C1820602%2C1821448%2C1822413%2C1824828" rel="external nofollow">Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10</a>
</li>
</ul></div>
</blockquote>
