Severity
Medium
Analysis Summary
CVE-2023-28177 CVSS:8.8
Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVE-2023-28176 CVSS:8.8
Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVE-2023-28163 CVSS:6.5
Mozilla Firefox could provide weaker than expected, caused by an error when the Windows Save As dialog resolve environment variables. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to launch further attacks on the system.
CVE-2023-25752 CVSS:6.5
Mozilla Firefox could provide weaker than expected, caused by an out-of-bounds when accessing throttled streams. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to lead future code to be incorrect and vulnerable.
CVE-2023-28162 CVSS:6.5
Mozilla Firefox is vulnerable to a denial of service, caused by invalid downcast in Worklets. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to cause the browser to crash.
CVE-2023-28161 CVSS:6.5
Mozilla Firefox could provide weaker than expected, caused by an error when one-time permissions granted to a local file were extended to other local files loaded in the same tab. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to launch further attacks on the system.
CVE-2023-28160 CVSS:6.5
Mozilla Firefox could allow a remote attacker to obtain sensitive information, caused by the leak of the local path when following a redirect to a publicly accessible web extension file. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to obtain sensitive information.
CVE-2023-25751 CVSS:6.5
Mozilla Firefox is vulnerable to a denial of service, caused by incorrect code generation during JIT compilation. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to cause the browser to crash.
CVE-2023-25750 CVSS:6.5
Mozilla Firefox could allow a remote attacker to obtain sensitive information, caused by the leak of a ServiceWorker’s offline cache when using private browsing mode. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to obtain sensitive information.
CVE-2023-25749 CVSS:6.5
Mozilla Firefox for Android could provide weaker than expected security, caused by the opening of third-party apps without prompt. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to launch android applications with unpatched vulnerabilities.
CVE-2023-25748 CVSS:6.5
Mozilla Firefox for Android could allow a remote attacker to conduct spoofing attacks, caused by the hiding of the fullscreen notification using window prompts. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to cause user confusion or perform spoofing attacks.
CVE-2023-28159 CVSS:6.5
Mozilla Firefox for Android could allow a remote attacker to conduct spoofing attacks, caused by the hiding of the fullscreen notification using download popups. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to cause user confusion or perform spoofing attacks.
CVE-2023-28164 CVSS:6.5
Mozilla Firefox could allow a remote attacker to conduct spoofing attacks, caused by dragging a URL from a cross-origin iframe that was removed during the drag. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to cause user confusion or perform spoofing attacks.
Impact
- Code Execution
- Denial of Service
- Information Disclosure
- Unauthorized Access
Indicators Of Compromise
CVE
- CVE-2023-28177
- CVE-2023-28176
- CVE-2023-28163
- CVE-2023-25752
- CVE-2023-28162
- CVE-2023-28161
- CVE-2023-28160
- CVE-2023-25751
- CVE-2023-25750
- CVE-2023-25749
- CVE-2023-25748
- CVE-2023-28159
- CVE-2023-28164
Affected Vendors
Mozilla
Affected Products
- Mozilla firefox 110
- Mozilla Firefox for Android 110
- Mozilla Firefox ESR 102.8
Remediation
Refer to Mozilla Foundation Security Advisory for patch, upgrade or suggested workaround information.