When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
References
| Link | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1842030 | Issue Tracking |
| https://www.mozilla.org/security/advisories/mfsa2023-34/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2023-36/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2023-38/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
19 Sep 2024, 20:35
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-754 |
14 Sep 2023, 03:52
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://bugzilla.mozilla.org/show_bug.cgi?id=1842030 - Issue Tracking | |
| References | (MISC) https://www.mozilla.org/security/advisories/mfsa2023-34/ - Vendor Advisory | |
| References | (MISC) https://www.mozilla.org/security/advisories/mfsa2023-38/ - Vendor Advisory | |
| References | (MISC) https://www.mozilla.org/security/advisories/mfsa2023-36/ - Vendor Advisory | |
| First Time |
Mozilla thunderbird
Mozilla firefox Mozilla firefox Esr Mozilla |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
|
| CWE | NVD-CWE-noinfo |
11 Sep 2023, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-11 09:15
Updated : 2024-09-19 20:35
NVD link : CVE-2023-4583
Mitre link : CVE-2023-4583
CVE.ORG link : CVE-2023-4583
JSON object : View
Products Affected
mozilla
- firefox
- thunderbird
- firefox_esr
CWE