Log in Start free

Vulnerability · Published Mar 19, 2024 · Assigned by mozilla

CVE-2023-5388

Medium 6.5

In plain English

A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.0%top 37.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8firefox115.9.1-1.el8_9.alma.1ALSA-2024:1484
AlmaLinux:9firefox115.9.1-1.el9_3.alma.1ALSA-2024:1485
AlmaLinux:9firefox-x11115.9.1-1.el9_3.alma.1ALSA-2024:1485
AlmaLinux:9nspr4.35.0-4.el9_3ALSA-2024:0108
AlmaLinux:9nspr-devel4.35.0-4.el9_3ALSA-2024:0108
AlmaLinux:8nss3.90.0-4.el8_9ALSA-2024:0105
AlmaLinux:9nss3.90.0-4.el9_3ALSA-2024:0108
AlmaLinux:8nss-devel3.90.0-4.el8_9ALSA-2024:0105
AlmaLinux:9nss-devel3.90.0-4.el9_3ALSA-2024:0108
AlmaLinux:8nss-softokn3.90.0-4.el8_9ALSA-2024:0105
AlmaLinux:9nss-softokn3.90.0-4.el9_3ALSA-2024:0108
AlmaLinux:8nss-softokn-devel3.90.0-4.el8_9ALSA-2024:0105
AlmaLinux:9nss-softokn-devel3.90.0-4.el9_3ALSA-2024:0108
AlmaLinux:8nss-softokn-freebl3.90.0-4.el8_9ALSA-2024:0105
AlmaLinux:9nss-softokn-freebl3.90.0-4.el9_3ALSA-2024:0108
AlmaLinux:8nss-softokn-freebl-devel3.90.0-4.el8_9ALSA-2024:0105
AlmaLinux:9nss-softokn-freebl-devel3.90.0-4.el9_3ALSA-2024:0108
AlmaLinux:8nss-sysinit3.90.0-4.el8_9ALSA-2024:0105
AlmaLinux:9nss-sysinit3.90.0-4.el9_3ALSA-2024:0108
AlmaLinux:8nss-tools3.90.0-4.el8_9ALSA-2024:0105
AlmaLinux:9nss-tools3.90.0-4.el9_3ALSA-2024:0108
AlmaLinux:8nss-util3.90.0-4.el8_9ALSA-2024:0105
AlmaLinux:9nss-util3.90.0-4.el9_3ALSA-2024:0108
AlmaLinux:8nss-util-devel3.90.0-4.el8_9ALSA-2024:0105
AlmaLinux:9nss-util-devel3.90.0-4.el9_3ALSA-2024:0108
AlmaLinux:8thunderbird115.9.0-1.el8_9.alma.1ALSA-2024:1494
AlmaLinux:9thunderbird115.9.0-1.el9_3.alma.1ALSA-2024:1493
Alpine:v3.20nss3.98-r0ALPINE-CVE-2023-5388
Alpine:v3.21nss3.98-r0ALPINE-CVE-2023-5388
Alpine:v3.22nss3.98-r0ALPINE-CVE-2023-5388
Alpine:v3.23nss3.98-r0ALPINE-CVE-2023-5388
Alpine:v3.24nss3.98-r0ALPINE-CVE-2023-5388
Debian:12firefox-esr115.9.0esr-1~deb12u1DEBIAN-CVE-2023-5388
Debian:12firefox-esr115.9.0esr-1~deb12u1DSA-5643-1
Debian:13firefox-esr115.9.0esr-1DEBIAN-CVE-2023-5388
Debian:14firefox-esr115.9.0esr-1DEBIAN-CVE-2023-5388
Debian:12nssno fix listedDEBIAN-CVE-2023-5388
Debian:13nss2:3.98-1DEBIAN-CVE-2023-5388
Debian:14nss2:3.98-1DEBIAN-CVE-2023-5388
Debian:12thunderbird1:115.9.0-1~deb12u1DSA-5644-1
Debian:12thunderbird1:115.9.0-1~deb12u1DEBIAN-CVE-2023-5388
Debian:13thunderbird1:115.9.0-1DEBIAN-CVE-2023-5388
Debian:14thunderbird1:115.9.0-1DEBIAN-CVE-2023-5388
Rocky Linux:8firefox0:115.9.1-1.el8_9RLSA-2024:1484
Rocky Linux:8nss0:3.90.0-4.el8_9RLSA-2024:0105
Rocky Linux:8thunderbird0:115.9.0-1.el8_9RLSA-2024:1494
Ubuntu:22.04:LTSmozjs102no fix listedUBUNTU-CVE-2023-5388
Ubuntu:24.04:LTSmozjs102no fix listedUBUNTU-CVE-2023-5388
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2023-5388
Ubuntu:22.04:LTSmozjs91no fix listedUBUNTU-CVE-2023-5388
Ubuntu:22.04:LTSnss2:3.98-0ubuntu0.22.04.1USN-6727-1
Ubuntu:22.04:LTSnss2:3.98-0ubuntu0.22.04.1UBUNTU-CVE-2023-5388
Ubuntu:22.04:LTSthunderbird1:115.9.0+build1-0ubuntu0.22.04.1UBUNTU-CVE-2023-5388
Ubuntu:22.04:LTSthunderbird1:115.9.0+build1-0ubuntu0.22.04.1USN-6717-1

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 124
Mozilla Firefox ESR unspecified – before 115.9
Mozilla Thunderbird unspecified – before 115.9

References