#CVE-2023-1999: Double-free in libwebp Reporter Irvan Kurniawan Impact high DescriptionĪ double-free in libwebp could have led to memory corruption and a potentially exploitable crash. Other versions of Firefox are unaffected. This bug only affects Firefox and Focus for Android. These could have led to potential user confusion and spoofing attacks. #CVE-2023-29534: Fullscreen notification could have been obscured on Firefox for Android Reporter Shaheen Fazim and Hafiizh Impact high Descriptionĭifferent techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. This could have led to user confusion and possible spoofing attacks. #CVE-2023-29533: Fullscreen notification obscured Reporter Irvan Kurniawan Impact high DescriptionĪ website could have obscured the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. Other operating systems are not affected. Note: This attack requires local system access and only affects Windows. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server. #CVE-2023-29532: Mozilla Maintenance Service Write-lock bypass Reporter Holger Fuhrmannek Impact high DescriptionĪ local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. #CVE-2023-29531: Out-of-bound memory access in WebGL on macOS Reporter DoHyun Lee Impact high DescriptionĪn attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash. Mozilla Foundation Security Advisory 2023-13 Security Vulnerabilities fixed in Firefox 112, Firefox for Android 112, Focus for Android 112 Announced ApImpact high Products Firefox, Firefox for Android, Focus for Android Fixed in

Mozilla firefox focus