CVE-2023-4583 - Browsing Context potentially not cleared when closing Private Window

Back Back to CVE browser

HIGH

Browsing Context potentially not cleared when closing Private Window

Published Sep 11, 2023

7.5

HIGH

CVSS 3.1

EPSS 0.69%

Description

When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <117
Vendor Mozilla Product Firefox ESR Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <115.2
Vendor Mozilla Product Thunderbird Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <115.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
unspecified	affected	<117

Mozilla

Firefox ESR

n/a

Version	Status	Constraints
unspecified	affected	<115.2

Mozilla

Thunderbird

n/a

Version	Status	Constraints
unspecified	affected	<115.2

Red Hat Enterprise Linux 7

firefox-0:102.15.0-1.el7_9

Fixed · RHSA-2023:5019
Red Hat Enterprise Linux 7

thunderbird-0:102.15.0-1.el7_9

Fixed · RHSA-2023:4945
Red Hat Enterprise Linux 8

firefox-0:102.15.0-1.el8_8

Fixed · RHSA-2023:4952
Red Hat Enterprise Linux 8

thunderbird-0:102.15.0-1.el8_8

Fixed · RHSA-2023:4954
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

firefox-0:102.15.0-1.el8_1

Fixed · RHSA-2023:4949
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

thunderbird-0:102.15.0-1.el8_1

Fixed · RHSA-2023:4948
Red Hat Enterprise Linux 8.2 Advanced Update Support

firefox-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Advanced Update Support

thunderbird-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4946
Red Hat Enterprise Linux 8.2 Telecommunications Update Service

firefox-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Telecommunications Update Service

thunderbird-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4946
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

firefox-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

thunderbird-0:102.15.0-1.el8_2

Fixed · RHSA-2023:4946
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

firefox-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

thunderbird-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4956
Red Hat Enterprise Linux 8.4 Telecommunications Update Service

firefox-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Telecommunications Update Service

thunderbird-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4956
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

firefox-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

thunderbird-0:102.15.0-1.el8_4

Fixed · RHSA-2023:4956
Red Hat Enterprise Linux 8.6 Extended Update Support

firefox-0:102.15.0-1.el8_6

Fixed · RHSA-2023:4959
Red Hat Enterprise Linux 9

firefox-0:102.15.0-1.el9_2

Fixed · RHSA-2023:4958
Red Hat Enterprise Linux 9

thunderbird-0:102.15.0-1.el9_2

Fixed · RHSA-2023:4955
Red Hat Enterprise Linux 9.0 Extended Update Support

firefox-0:102.15.0-1.el9_0

Fixed · RHSA-2023:4950
Red Hat Enterprise Linux 9.0 Extended Update Support

thunderbird-0:102.15.0-1.el9_0

Fixed · RHSA-2023:4947
Red Hat Enterprise Linux 6

firefox

Out of support scope
Red Hat Enterprise Linux 6

thunderbird

Out of support scope

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	firefox-0:102.15.0-1.el7_9	Fixed	RHSA-2023:5019
Red Hat Enterprise Linux 7	thunderbird-0:102.15.0-1.el7_9	Fixed	RHSA-2023:4945
Red Hat Enterprise Linux 8	firefox-0:102.15.0-1.el8_8	Fixed	RHSA-2023:4952
Red Hat Enterprise Linux 8	thunderbird-0:102.15.0-1.el8_8	Fixed	RHSA-2023:4954
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions	firefox-0:102.15.0-1.el8_1	Fixed	RHSA-2023:4949
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions	thunderbird-0:102.15.0-1.el8_1	Fixed	RHSA-2023:4948
Red Hat Enterprise Linux 8.2 Advanced Update Support	firefox-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Advanced Update Support	thunderbird-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4946
Red Hat Enterprise Linux 8.2 Telecommunications Update Service	firefox-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Telecommunications Update Service	thunderbird-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4946
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	firefox-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4951
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	thunderbird-0:102.15.0-1.el8_2	Fixed	RHSA-2023:4946
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	firefox-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	thunderbird-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4956
Red Hat Enterprise Linux 8.4 Telecommunications Update Service	firefox-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Telecommunications Update Service	thunderbird-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4956
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	firefox-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4957
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	thunderbird-0:102.15.0-1.el8_4	Fixed	RHSA-2023:4956
Red Hat Enterprise Linux 8.6 Extended Update Support	firefox-0:102.15.0-1.el8_6	Fixed	RHSA-2023:4959
Red Hat Enterprise Linux 9	firefox-0:102.15.0-1.el9_2	Fixed	RHSA-2023:4958
Red Hat Enterprise Linux 9	thunderbird-0:102.15.0-1.el9_2	Fixed	RHSA-2023:4955
Red Hat Enterprise Linux 9.0 Extended Update Support	firefox-0:102.15.0-1.el9_0	Fixed	RHSA-2023:4950
Red Hat Enterprise Linux 9.0 Extended Update Support	thunderbird-0:102.15.0-1.el9_0	Fixed	RHSA-2023:4947
Red Hat Enterprise Linux 6	firefox	Out of support scope	n/a
Red Hat Enterprise Linux 6	thunderbird	Out of support scope	n/a

Remediation

Red Hat statement

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Weaknesses (2)

CWE-179

CWE-754

References (10)

https://access.redhat.com/security/cve/CVE-2023-4583
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1842030
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2236082
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54437
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-4583
https://www.cve.org/CVERecord?id=CVE-2023-4583
https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/#CVE-2023-4583
https://www.mozilla.org/security/advisories/mfsa2023-34/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-36/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-38/
Vendor Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2023-4583		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1842030		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2236082		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54437		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-4583
https://www.cve.org/CVERecord?id=CVE-2023-4583
https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/#CVE-2023-4583
https://www.mozilla.org/security/advisories/mfsa2023-34/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-36/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-38/		Vendor Advisory