A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the file:// context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file read. This vulnerability affects Firefox < 109.
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Firefox | Mozilla | * | 109.0 (excluding) |
Firefox | Ubuntu | bionic | * |
Firefox | Ubuntu | focal | * |
Firefox | Ubuntu | trusty | * |
Firefox | Ubuntu | xenial | * |
Mozjs38 | Ubuntu | bionic | * |
Mozjs38 | Ubuntu | esm-apps/bionic | * |
Mozjs38 | Ubuntu | upstream | * |
Mozjs52 | Ubuntu | bionic | * |
Mozjs52 | Ubuntu | esm-apps/focal | * |
Mozjs52 | Ubuntu | esm-infra/bionic | * |
Mozjs52 | Ubuntu | focal | * |
Mozjs52 | Ubuntu | upstream | * |
Mozjs68 | Ubuntu | focal | * |
Mozjs68 | Ubuntu | upstream | * |
Mozjs78 | Ubuntu | esm-apps/jammy | * |
Mozjs78 | Ubuntu | jammy | * |
Mozjs78 | Ubuntu | kinetic | * |
Mozjs78 | Ubuntu | lunar | * |
Mozjs78 | Ubuntu | upstream | * |
Mozjs91 | Ubuntu | jammy | * |
Mozjs91 | Ubuntu | upstream | * |
Thunderbird | Ubuntu | bionic | * |
Thunderbird | Ubuntu | kinetic | * |
Thunderbird | Ubuntu | trusty | * |
Thunderbird | Ubuntu | xenial | * |