SB2023041476 - Red Hat Enterprise Linux 8.4 Extended Update Support update for firefox
Published: April 14, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2023-1945)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the Safe Browsing API. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Spoofing attack (CVE-ID: CVE-2023-29533)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data. A remote attacker can hide the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls.
3) Buffer overflow (CVE-ID: CVE-2023-29535)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error during Garbage Collector compaction. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Release of invalid pointer or reference (CVE-ID: CVE-2023-29536)
The vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to an invalid free operation from JavaScript code. A remote attacker can trick the victim to visit a specially crafted web page, trigger memory corruption and execute arbitrary code.
5) Security features bypass (CVE-ID: CVE-2023-29539)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to improper handling of filename directive in the Content-Disposition header, which leads to filename truncation if it contains a NULL character. A remote attacker can abuse such behavior and trick the victim into downloading a malicious file.
6) Security features bypass (CVE-ID: CVE-2023-29541)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to improper handling of filenames ending with .desktop. A remote attacker can trick the victim into downloading a malicious file and execute it on the system.The vulnerability affects Firefox on Linux only.
7) Processor optimization removal or modification of security-critical code (CVE-ID: CVE-2023-29548)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to usage of a wrong lowering instruction in the ARM64 Ion compiler. A remote attacker can gain access to sensitive information.
8) Buffer overflow (CVE-ID: CVE-2023-29550)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when parsing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.