{"id":"USN-5816-2","summary":"firefox regressions","details":"USN-5816-1 fixed vulnerabilities in Firefox. The update introduced\nseveral minor regressions. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Niklas Baumstark discovered that a compromised web child process of Firefox\n could disable web security opening restrictions, leading to a new child\n process being spawned within the file:// context. An attacker could\n potentially exploits this to obtain sensitive information. (CVE-2023-23597)\n \n Tom Schuster discovered that Firefox was not performing a validation check\n on GTK drag data. An attacker could potentially exploits this to obtain\n sensitive information. (CVE-2023-23598)\n \n Vadim discovered that Firefox was not properly sanitizing a curl command\n output when copying a network request from the developer tools panel. An\n attacker could potentially exploits this to hide and execute arbitrary\n commands. (CVE-2023-23599)\n \n Luan Herrera discovered that Firefox was not stopping navigation when\n dragging a URL from a cross-origin iframe into the same tab. An attacker\n potentially exploits this to spoof the user. (CVE-2023-23601)\n \n Dave Vandyke discovered that Firefox did not properly implement CSP policy\n when creating a WebSocket in a WebWorker. An attacker who was able to\n inject markup into a page otherwise protected by a Content Security Policy\n may have been able to inject an executable script. (CVE-2023-23602)\n \n Dan Veditz discovered that Firefox did not properly implement CSP policy\n on regular expression when using console.log. An attacker potentially\n exploits this to exfiltrate data from the browser. (CVE-2023-23603)\n \n Nika Layzell discovered that Firefox was not performing a validation check\n when parsing a non-system html document via DOMParser::ParseFromSafeString.\n An attacker potentially exploits this to bypass web security checks.\n (CVE-2023-23604)\n \n Multiple security issues were discovered in Firefox. If a user were\n tricked into opening a specially crafted website, an attacker could\n potentially exploit these to cause a denial of service, obtain sensitive\n information across domains, or execute arbitrary code. (CVE-2023-23605,\n CVE-2023-23606)\n","modified":"2026-02-10T04:42:55Z","published":"2023-02-06T03:30:46Z","references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-5816-2"},{"type":"REPORT","url":"https://launchpad.net/bugs/2006075"}],"affected":[{"package":{"name":"firefox","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/firefox@109.0.1+build1-0ubuntu0.18.04.2?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"109.0.1+build1-0ubuntu0.18.04.2"}]}],"versions":["56.0+build6-0ubuntu1","57.0.1+build2-0ubuntu1","59.0.1+build1-0ubuntu1","59.0.2+build1-0ubuntu1","60.0+build2-0ubuntu1","60.0.1+build2-0ubuntu0.18.04.1","60.0.2+build1-0ubuntu0.18.04.1","61.0+build3-0ubuntu0.18.04.1","61.0.1+build1-0ubuntu0.18.04.1","62.0+build2-0ubuntu0.18.04.3","62.0+build2-0ubuntu0.18.04.4","62.0+build2-0ubuntu0.18.04.5","62.0.3+build1-0ubuntu0.18.04.1","63.0+build2-0ubuntu0.18.04.2","63.0.3+build1-0ubuntu0.18.04.1","64.0+build3-0ubuntu0.18.04.1","65.0+build2-0ubuntu0.18.04.1","65.0.1+build2-0ubuntu0.18.04.1","66.0+build3-0ubuntu0.18.04.1","66.0.1+build1-0ubuntu0.18.04.1","66.0.2+build1-0ubuntu0.18.04.1","66.0.3+build1-0ubuntu0.18.04.1","66.0.4+build3-0ubuntu0.18.04.1","66.0.5+build1-0ubuntu0.18.04.1","67.0+build2-0ubuntu0.18.04.1","67.0.1+build1-0ubuntu0.18.04.1","67.0.2+build2-0ubuntu0.18.04.1","67.0.3+build1-0ubuntu0.18.04.1","67.0.4+build1-0ubuntu0.18.04.1","68.0+build3-0ubuntu0.18.04.1","68.0.1+build1-0ubuntu0.18.04.1","68.0.2+build1-0ubuntu0.18.04.1","69.0+build2-0ubuntu0.18.04.1","69.0.1+build1-0ubuntu0.18.04.1","69.0.2+build1-0ubuntu0.18.04.1","70.0+build2-0ubuntu0.18.04.1","70.0.1+build1-0ubuntu0.18.04.1","71.0+build5-0ubuntu0.18.04.1","72.0.1+build1-0ubuntu0.18.04.1","72.0.2+build1-0ubuntu0.18.04.1","73.0+build3-0ubuntu0.18.04.1","73.0.1+build1-0ubuntu0.18.04.1","74.0+build3-0ubuntu0.18.04.1","74.0.1+build1-0ubuntu0.18.04.1","75.0+build3-0ubuntu0.18.04.1","76.0+build2-0ubuntu0.18.04.1","76.0.1+build1-0ubuntu0.18.04.1","77.0.1+build1-0ubuntu0.18.04.1","78.0.1+build1-0ubuntu0.18.04.1","78.0.2+build2-0ubuntu0.18.04.1","79.0+build1-0ubuntu0.18.04.1","80.0+build2-0ubuntu0.18.04.1","80.0.1+build1-0ubuntu0.18.04.1","81.0+build2-0ubuntu0.18.04.1","81.0.2+build1-0ubuntu0.18.04.1","82.0+build2-0ubuntu0.18.04.1","82.0.2+build1-0ubuntu0.18.04.1","82.0.3+build1-0ubuntu0.18.04.1","83.0+build2-0ubuntu0.18.04.2","84.0+build3-0ubuntu0.18.04.1","84.0.1+build1-0ubuntu0.18.04.1","84.0.2+build1-0ubuntu0.18.04.1","85.0+build1-0ubuntu0.18.04.1","85.0.1+build1-0ubuntu0.18.04.1","86.0+build3-0ubuntu0.18.04.1","86.0.1+build1-0ubuntu0.18.04.1","87.0+build3-0ubuntu0.18.04.2","88.0+build2-0ubuntu0.18.04.2","88.0.1+build1-0ubuntu0.18.04.2","89.0+build2-0ubuntu0.18.04.2","89.0.1+build1-0ubuntu0.18.04.1","89.0.2+build1-0ubuntu0.18.04.1","90.0+build1-0ubuntu0.18.04.1","90.0.2+build1-0ubuntu0.18.04.1","91.0+build2-0ubuntu0.18.04.1","91.0.1+build1-0ubuntu0.18.04.1","91.0.2+build1-0ubuntu0.18.04.1","92.0+build3-0ubuntu0.18.04.1","93.0+build1-0ubuntu0.18.04.1","94.0+build3-0ubuntu0.18.04.1","95.0+build1-0ubuntu0.18.04.1","95.0.1+build2-0ubuntu0.18.04.1","96.0+build2-0ubuntu0.18.04.1","97.0+build2-0ubuntu0.18.04.1","97.0.2+build1-0ubuntu0.18.04.1","98.0+build3-0ubuntu0.18.04.2","98.0.1+build2-0ubuntu0.18.04.1","98.0.2+build1-0ubuntu0.18.04.1","99.0+build2-0ubuntu0.18.04.2","100.0+build2-0ubuntu0.18.04.1","100.0.2+build1-0ubuntu0.18.04.1","101.0.1+build1-0ubuntu0.18.04.1","102.0+build2-0ubuntu0.18.04.1","103.0+build1-0ubuntu0.18.04.1","104.0+build3-0ubuntu0.18.04.1","105.0+build2-0ubuntu0.18.04.1","106.0.2+build1-0ubuntu0.18.04.1","106.0.5+build1-0ubuntu0.18.04.1","107.0+build2-0ubuntu0.18.04.1","108.0+build2-0ubuntu0.18.04.1","108.0.1+build1-0ubuntu0.18.04.1","108.0.2+build1-0ubuntu0.18.04.1","109.0+build2-0ubuntu0.18.04.1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"109.0.1+build1-0ubuntu0.18.04.2","binary_name":"firefox"},{"binary_version":"109.0.1+build1-0ubuntu0.18.04.2","binary_name":"firefox-dev"},{"binary_version":"109.0.1+build1-0ubuntu0.18.04.2","binary_name":"firefox-geckodriver"},{"binary_version":"109.0.1+build1-0ubuntu0.18.04.2","binary_name":"firefox-mozsymbols"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:18.04:LTS","cves":[]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-5816-2.json"}},{"package":{"name":"firefox","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/firefox@109.0.1+build1-0ubuntu0.20.04.2?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"109.0.1+build1-0ubuntu0.20.04.2"}]}],"versions":["69.0.3+build1-0ubuntu1","70.0+build2-0ubuntu1","70.0+build2-0ubuntu2","70.0.1+build1-0ubuntu2","71.0+build2-0ubuntu2","71.0+build5-0ubuntu1","72.0.1+build1-0ubuntu1","72.0.2+build1-0ubuntu1","73.0+build1-0ubuntu1","73.0+build2-0ubuntu1","73.0+build3-0ubuntu1","73.0.1+build1-0ubuntu1","74.0+build1-0ubuntu1","74.0+build2-0ubuntu1","74.0+build2-0ubuntu2","74.0+build3-0ubuntu1","75.0+build3-0ubuntu1","76.0+build2-0ubuntu0.20.04.1","76.0.1+build1-0ubuntu0.20.04.1","77.0.1+build1-0ubuntu0.20.04.1","78.0.1+build1-0ubuntu0.20.04.1","78.0.2+build2-0ubuntu0.20.04.1","79.0+build1-0ubuntu0.20.04.1","80.0+build2-0ubuntu0.20.04.1","80.0.1+build1-0ubuntu0.20.04.1","81.0+build2-0ubuntu0.20.04.1","81.0.2+build1-0ubuntu0.20.04.1","82.0+build2-0ubuntu0.20.04.1","82.0.2+build1-0ubuntu0.20.04.1","82.0.3+build1-0ubuntu0.20.04.1","83.0+build2-0ubuntu0.20.04.1","84.0+build3-0ubuntu0.20.04.1","84.0.1+build1-0ubuntu0.20.04.1","84.0.2+build1-0ubuntu0.20.04.1","85.0+build1-0ubuntu0.20.04.1","85.0.1+build1-0ubuntu0.20.04.1","86.0+build3-0ubuntu0.20.04.1","86.0.1+build1-0ubuntu0.20.04.1","87.0+build3-0ubuntu0.20.04.2","88.0+build2-0ubuntu0.20.04.1","88.0.1+build1-0ubuntu0.20.04.2","89.0+build2-0ubuntu0.20.04.2","89.0.1+build1-0ubuntu0.20.04.1","89.0.2+build1-0ubuntu0.20.04.1","90.0+build1-0ubuntu0.20.04.1","90.0.2+build1-0ubuntu0.20.04.1","91.0+build2-0ubuntu0.20.04.1","91.0.1+build1-0ubuntu0.20.04.1","91.0.2+build1-0ubuntu0.20.04.1","92.0+build3-0ubuntu0.20.04.1","93.0+build1-0ubuntu0.20.04.1","94.0+build3-0ubuntu0.20.04.1","95.0+build1-0ubuntu0.20.04.1","95.0.1+build2-0ubuntu0.20.04.1","96.0+build2-0ubuntu0.20.04.1","97.0+build2-0ubuntu0.20.04.1","97.0.2+build1-0ubuntu0.20.04.1","98.0+build3-0ubuntu0.20.04.2","98.0.1+build2-0ubuntu0.20.04.1","98.0.2+build1-0ubuntu0.20.04.1","99.0+build2-0ubuntu0.20.04.2","100.0+build2-0ubuntu0.20.04.1","100.0.2+build1-0ubuntu0.20.04.1","101.0.1+build1-0ubuntu0.20.04.1","102.0+build2-0ubuntu0.20.04.1","103.0+build1-0ubuntu0.20.04.1","104.0+build3-0ubuntu0.20.04.1","105.0+build2-0ubuntu0.20.04.1","106.0.2+build1-0ubuntu0.20.04.1","106.0.5+build1-0ubuntu0.20.04.1","107.0+build2-0ubuntu0.20.04.1","108.0+build2-0ubuntu0.20.04.1","108.0.1+build1-0ubuntu0.20.04.1","108.0.2+build1-0ubuntu0.20.04.1","109.0+build2-0ubuntu0.20.04.1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"109.0.1+build1-0ubuntu0.20.04.2","binary_name":"firefox"},{"binary_version":"109.0.1+build1-0ubuntu0.20.04.2","binary_name":"firefox-dev"},{"binary_version":"109.0.1+build1-0ubuntu0.20.04.2","binary_name":"firefox-geckodriver"},{"binary_version":"109.0.1+build1-0ubuntu0.20.04.2","binary_name":"firefox-mozsymbols"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:20.04:LTS","cves":[]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-5816-2.json"}}],"schema_version":"1.7.3"}