When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
References
| Link | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1842030 | Issue Tracking |
| https://www.mozilla.org/security/advisories/mfsa2023-34/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2023-36/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2023-38/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
14 Sep 2023, 03:52
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mozilla thunderbird
Mozilla firefox Esr Mozilla Mozilla firefox |
|
| References | (MISC) https://bugzilla.mozilla.org/show_bug.cgi?id=1842030 - Issue Tracking | |
| References | (MISC) https://www.mozilla.org/security/advisories/mfsa2023-36/ - Vendor Advisory | |
| References | (MISC) https://www.mozilla.org/security/advisories/mfsa2023-38/ - Vendor Advisory | |
| References | (MISC) https://www.mozilla.org/security/advisories/mfsa2023-34/ - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* |
11 Sep 2023, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-11 09:15
Updated : 2023-12-10 15:14
NVD link : CVE-2023-4583
Mitre link : CVE-2023-4583
CVE.ORG link : CVE-2023-4583
JSON object : View
Products Affected
mozilla
- firefox_esr
- thunderbird
- firefox
CWE