Log in Start free

Vulnerability · Published Jun 19, 2023 · Assigned by mozilla

CVE-2023-34414

Low 3.1

In plain English

A low-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)3.1Low
Exploit odds (30 days)0.9%top 40.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user clicks in precise locations immediately before navigating to a site with a certificate error and made the renderer extremely busy at the same time, it could create a gap between when the error page was loaded and when the display actually refreshed. With the right timing the elicited clicks could land in that gap and activate the button that overrides the certificate error for that site. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8firefox102.12.0-1.el8_8.almaALSA-2023:3590
AlmaLinux:9firefox102.12.0-1.el9_2.almaALSA-2023:3589
AlmaLinux:9firefox-x11102.12.0-1.el9_2.almaALSA-2023:3589
AlmaLinux:8thunderbird102.12.0-1.el8_8.almaALSA-2023:3588
AlmaLinux:9thunderbird102.12.0-1.el9_2.almaALSA-2023:3587
Alpine:v3.20firefox-esr102.12.0-r0ALPINE-CVE-2023-34414
Alpine:v3.21firefox-esr102.12.0-r0ALPINE-CVE-2023-34414
Alpine:v3.22firefox-esr102.12.0-r0ALPINE-CVE-2023-34414
Alpine:v3.23firefox-esr102.12.0-r0ALPINE-CVE-2023-34414
Debian:12firefox-esr102.12.0esr-1~deb12u1DSA-5421-1
Debian:12firefox-esr102.12.0esr-1~deb12u1DEBIAN-CVE-2023-34414
Debian:13firefox-esr102.12.0esr-1DEBIAN-CVE-2023-34414
Debian:14firefox-esr102.12.0esr-1DEBIAN-CVE-2023-34414
Debian:12thunderbird1:102.12.0-1~deb12u1DSA-5423-1
Debian:12thunderbird1:102.12.0-1~deb12u1DEBIAN-CVE-2023-34414
Debian:13thunderbird1:102.12.0-1DEBIAN-CVE-2023-34414
Debian:14thunderbird1:102.12.0-1DEBIAN-CVE-2023-34414
Rocky Linux:8firefox0:102.12.0-1.el8_8RLSA-2023:3590
Rocky Linux:8thunderbird0:102.12.0-1.el8_8RLSA-2023:3588
Rocky Linux:9thunderbird0:102.12.0-1.el9_2RLSA-2023:3587
Ubuntu:22.04:LTSthunderbird1:102.13.0+build1-0ubuntu0.22.04.1UBUNTU-CVE-2023-34414
Ubuntu:22.04:LTSthunderbird1:102.13.0+build1-0ubuntu0.22.04.1USN-6214-1

Affected products (as reported)

VendorProductVersions
Mozilla Firefox ESR unspecified – before 102.12
Mozilla Firefox unspecified – before 114
Mozilla Thunderbird unspecified – before 102.12

References