Log in Start free

Vulnerability · Published Jun 2, 2023 · Assigned by mozilla

CVE-2023-29533

Medium 4.3

In plain English

A medium-severity security flaw in Firefox from Mozilla. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.3Medium
Exploit odds (30 days)0.6%top 52.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8firefox102.10.0-1.el8_7.almaALSA-2023:1787
AlmaLinux:9firefox102.10.0-1.el9_1.almaALSA-2023:1786
AlmaLinux:9firefox-x11102.10.0-1.el9_1.almaALSA-2023:1786
AlmaLinux:8thunderbird102.10.0-2.el8_7.almaALSA-2023:1802
AlmaLinux:9thunderbird102.10.0-2.el9_1.almaALSA-2023:1809
Alpine:v3.20firefox-esr102.10.0-r0ALPINE-CVE-2023-29533
Alpine:v3.21firefox-esr102.10.0-r0ALPINE-CVE-2023-29533
Alpine:v3.22firefox-esr102.10.0-r0ALPINE-CVE-2023-29533
Alpine:v3.23firefox-esr102.10.0-r0ALPINE-CVE-2023-29533
Debian:12firefox-esr102.10.0esr-1DEBIAN-CVE-2023-29533
Debian:13firefox-esr102.10.0esr-1DEBIAN-CVE-2023-29533
Debian:14firefox-esr102.10.0esr-1DEBIAN-CVE-2023-29533
Debian:12thunderbird1:102.10.0-1DEBIAN-CVE-2023-29533
Debian:13thunderbird1:102.10.0-1DEBIAN-CVE-2023-29533
Debian:14thunderbird1:102.10.0-1DEBIAN-CVE-2023-29533
Rocky Linux:8thunderbird0:102.10.0-2.el8_7RLSA-2023:1802
Rocky Linux:9thunderbird0:102.10.0-2.el9_1RLSA-2023:1809
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2023-29533
Ubuntu:22.04:LTSmozjs91no fix listedUBUNTU-CVE-2023-29533
Ubuntu:22.04:LTSthunderbird1:102.10.0+build2-0ubuntu0.22.04.1UBUNTU-CVE-2023-29533
Ubuntu:22.04:LTSthunderbird1:102.10.0+build2-0ubuntu0.22.04.1USN-6015-1

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 112
Mozilla Focus for Android unspecified – before 112
Mozilla Firefox ESR unspecified – before 102.10
Mozilla Firefox for Android unspecified – before 112
Mozilla Thunderbird unspecified – before 102.10

References