p PatchFirst

CVE-2023-34415

CVE-2023-34415

This page contains facts from public vulnerability sources. Check the original advisory before updating.

When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that document in the same process as the site that issued the redirect. This bypassed the site-isolation protections against Spectre-like attacks on sites that host an "open redirect". Firefox no longer follows HTTP redirects to data: URLs. This vulnerability affects Firefox < 114.

CVSS 6.1 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • firefox

    Versions
    • ≥ unspecified, < 114: Affected (custom)

    Update to 114

  • firefox Ubuntu:20.04:LTS

    Versions
    • 69.0.3+build1-0ubuntu1
    • 70.0+build2-0ubuntu1
    • 70.0+build2-0ubuntu2
    • 70.0.1+build1-0ubuntu2
    • 71.0+build2-0ubuntu2
    • 71.0+build5-0ubuntu1
    • 72.0.1+build1-0ubuntu1
    • 72.0.2+build1-0ubuntu1
    • 73.0+build1-0ubuntu1
    • 73.0+build2-0ubuntu1
    • 73.0+build3-0ubuntu1
    • 73.0.1+build1-0ubuntu1
    • 74.0+build1-0ubuntu1
    • 74.0+build2-0ubuntu1
    • 74.0+build2-0ubuntu2
    • 74.0+build3-0ubuntu1
    • 75.0+build3-0ubuntu1
    • 76.0+build2-0ubuntu0.20.04.1
    • 76.0.1+build1-0ubuntu0.20.04.1
    • 77.0.1+build1-0ubuntu0.20.04.1
    • 78.0.1+build1-0ubuntu0.20.04.1
    • 78.0.2+build2-0ubuntu0.20.04.1
    • 79.0+build1-0ubuntu0.20.04.1
    • 80.0+build2-0ubuntu0.20.04.1
    • 80.0.1+build1-0ubuntu0.20.04.1
    • 81.0+build2-0ubuntu0.20.04.1
    • 81.0.2+build1-0ubuntu0.20.04.1
    • 82.0+build2-0ubuntu0.20.04.1
    • 82.0.2+build1-0ubuntu0.20.04.1
    • 82.0.3+build1-0ubuntu0.20.04.1
    • 83.0+build2-0ubuntu0.20.04.1
    • 84.0+build3-0ubuntu0.20.04.1
    • 84.0.1+build1-0ubuntu0.20.04.1
    • 84.0.2+build1-0ubuntu0.20.04.1
    • 85.0+build1-0ubuntu0.20.04.1
    • 85.0.1+build1-0ubuntu0.20.04.1
    • 86.0+build3-0ubuntu0.20.04.1
    • 86.0.1+build1-0ubuntu0.20.04.1
    • 87.0+build3-0ubuntu0.20.04.2
    • 88.0+build2-0ubuntu0.20.04.1
    • 88.0.1+build1-0ubuntu0.20.04.2
    • 89.0+build2-0ubuntu0.20.04.2
    • 89.0.1+build1-0ubuntu0.20.04.1
    • 89.0.2+build1-0ubuntu0.20.04.1
    • 90.0+build1-0ubuntu0.20.04.1
    • 90.0.2+build1-0ubuntu0.20.04.1
    • 91.0+build2-0ubuntu0.20.04.1
    • 91.0.1+build1-0ubuntu0.20.04.1
    • 91.0.2+build1-0ubuntu0.20.04.1
    • 92.0+build3-0ubuntu0.20.04.1
    • 93.0+build1-0ubuntu0.20.04.1
    • 94.0+build3-0ubuntu0.20.04.1
    • 95.0+build1-0ubuntu0.20.04.1
    • 95.0.1+build2-0ubuntu0.20.04.1
    • 96.0+build2-0ubuntu0.20.04.1
    • 97.0+build2-0ubuntu0.20.04.1
    • 97.0.2+build1-0ubuntu0.20.04.1
    • 98.0+build3-0ubuntu0.20.04.2
    • 98.0.1+build2-0ubuntu0.20.04.1
    • 98.0.2+build1-0ubuntu0.20.04.1
    • 99.0+build2-0ubuntu0.20.04.2
    • 100.0+build2-0ubuntu0.20.04.1
    • 100.0.2+build1-0ubuntu0.20.04.1
    • 101.0.1+build1-0ubuntu0.20.04.1
    • 102.0+build2-0ubuntu0.20.04.1
    • 103.0+build1-0ubuntu0.20.04.1
    • 104.0+build3-0ubuntu0.20.04.1
    • 105.0+build2-0ubuntu0.20.04.1
    • 106.0.2+build1-0ubuntu0.20.04.1
    • 106.0.5+build1-0ubuntu0.20.04.1
    • 107.0+build2-0ubuntu0.20.04.1
    • 108.0+build2-0ubuntu0.20.04.1
    • 108.0.1+build1-0ubuntu0.20.04.1
    • 108.0.2+build1-0ubuntu0.20.04.1
    • 109.0+build2-0ubuntu0.20.04.1
    • 109.0.1+build1-0ubuntu0.20.04.2
    • 110.0+build3-0ubuntu0.20.04.1
    • 110.0.1+build2-0ubuntu0.20.04.1
    • 111.0+build2-0ubuntu0.20.04.1
    • 111.0.1+build2-0ubuntu0.20.04.1
    • 112.0+build2-0ubuntu0.20.04.1
    • 112.0.1+build1-0ubuntu0.20.04.1
    • 112.0.2+build1-0ubuntu0.20.04.1
    • 113.0+build2-0ubuntu0.20.04.1
    • 113.0.1+build1-0ubuntu0.20.04.1
    • 113.0.2+build1-0ubuntu0.20.04.1
    Affected ranges
    • ECOSYSTEM: < 114.0+build3-0ubuntu0.20.04.1

    Update to 114.0+build3-0ubuntu0.20.04.1

Original sources

Check your server →