Homepage
About Snyk

CVE-2023-4583 Affecting firefox package, versions <0:102.15.0-1.0.1.el7_9

Severity

 Recommended
0.0
high
0
10

Based on Oracle Linux security rating

    Threat Intelligence

    EPSS
    0.1% (42nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-ORACLE7-FIREFOX-5890782
  • published 6 Sep 2023
  • disclosed 11 Sep 2023
Report a new vulnerability Found a mistake?

Introduced: 6 Sep 2023

CVE-2023-4583 Open this link in a new tab

How to fix?

Upgrade Oracle:7 firefox to version 0:102.15.0-1.0.1.el7_9 or higher.
This issue was patched in ELSA-2023-5019.

NVD Description

Note: Versions mentioned in the description apply only to the upstream firefox package and not the firefox package as distributed by Oracle. See How to fix? for Oracle:7 relevant fixed versions and status.

When checking if the Browsing Context had been discarded in HttpBaseChannel, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.

CVSS Scores

version 3.1
Expand this section

NVD

7.5 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    None
  • Integrity (I)
    High
  • Availability (A)
    None
Expand this section

SUSE

7.5 high
Expand this section

Red Hat

7.5 high