CVE-2023-5721
Description
It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
Description Mozilla: Queued up rendering could have allowed websites to clickjack Red Hat statement Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Errata / fixed releases ProductPackageAdvisoryReleased Red Hat Enterprise Linux…
Description
Mozilla: Queued up rendering could have allowed websites to clickjack
Red Hat statement
Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Errata / fixed releases
| Product | Package | Advisory | Released |
|---|---|---|---|
| Red Hat Enterprise Linux 7 | firefox-0:115.4.0-1.el7_9 | RHSA-2023:6162 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 8 | firefox-0:115.4.0-1.el8_8 | RHSA-2023:6187 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 8 | thunderbird-0:115.4.1-1.el8_8 | RHSA-2023:6194 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions | firefox-0:115.4.0-1.el8_1 | RHSA-2023:6189 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions | thunderbird-0:115.4.1-1.el8_1 | RHSA-2023:6198 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | firefox-0:115.4.0-1.el8_2 | RHSA-2023:6185 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | thunderbird-0:115.4.1-1.el8_2 | RHSA-2023:6197 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 8.2 Telecommunications Update Service | firefox-0:115.4.0-1.el8_2 | RHSA-2023:6185 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 8.2 Telecommunications Update Service | thunderbird-0:115.4.1-1.el8_2 | RHSA-2023:6197 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions | firefox-0:115.4.0-1.el8_2 | RHSA-2023:6185 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions | thunderbird-0:115.4.1-1.el8_2 | RHSA-2023:6197 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | thunderbird-0:115.4.1-1.el8_4 | RHSA-2023:6196 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 8.4 Telecommunications Update Service | thunderbird-0:115.4.1-1.el8_4 | RHSA-2023:6196 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | thunderbird-0:115.4.1-1.el8_4 | RHSA-2023:6196 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 8.6 Extended Update Support | firefox-0:115.4.0-1.el8_6 | RHSA-2023:6186 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 8.6 Extended Update Support | thunderbird-0:115.4.1-1.el8_6 | RHSA-2023:6195 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 9 | firefox-0:115.4.0-1.el9_2 | RHSA-2023:6188 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 9 | thunderbird-0:115.4.1-1.el9_2 | RHSA-2023:6191 | 2023-10-30T00:00:00Z |
| Red Hat Enterprise Linux 9.0 Extended Update Support | firefox-0:115.4.0-1.el9_0 | RHSA-2023:6199 | 2023-10-30T00:00:00Z |
Package state
| Product | Package | State |
|---|---|---|
| Red Hat Enterprise Linux 6 | firefox | Out of support scope |
| Red Hat Enterprise Linux 6 | thunderbird | Out of support scope |
| Red Hat Enterprise Linux 7 | thunderbird | Affected |
Apply commands
yum update -y firefox
# or:
dnf upgrade -y firefoxAffected
| Vendor | Product | Version |
|---|---|---|
| redhat | Red Hat Enterprise Linux 7 | Affected |
OS impact
SUSE Affected 1 release
| Version | Status | Fixed in |
|---|---|---|
| — | Affected | — |
Debian Fixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 115.4.0esr-1 |
| sid | Fixed | 119.0-1 |
| forky | Fixed | 115.4.0esr-1 |
| bullseye | Fixed | 115.4.0esr-1~deb11u1 |
| bookworm | Fixed | 115.4.0esr-1~deb12u1 |
Red Hat Fixed 2 releases
| Version | Status | Fixed in |
|---|---|---|
| 9 | Fixed | — |
| 8 | Fixed | — |
Rocky Linux Fixed 1 release
| Version | Status | Fixed in |
|---|---|---|
| 9 | Fixed | — |
References
- https://access.redhat.com/errata/RHSA-2023:6188
- https://access.redhat.com/errata/RHSA-2023:6191
- https://security-tracker.debian.org/tracker/CVE-2023-5721
- https://www.suse.com/security/cve/CVE-2023-5721.html
- https://errata.rockylinux.org/RLSA-2023:6188
- https://access.redhat.com/errata/RHSA-2023:6187
- https://bugzilla.redhat.com/2241806
- https://bugzilla.redhat.com/2245896
- https://bugzilla.redhat.com/2245898
- https://bugzilla.redhat.com/2245899
- https://bugzilla.redhat.com/2245900
- https://bugzilla.redhat.com/2245903
- https://bugzilla.redhat.com/2245906
- https://errata.almalinux.org/8/ALSA-2023-6187.html
- https://access.redhat.com/errata/RHSA-2023:6194
- https://errata.almalinux.org/8/ALSA-2023-6194.html
- https://errata.almalinux.org/9/ALSA-2023-6188.html
- https://errata.almalinux.org/9/ALSA-2023-6191.html
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.