CVE-2023-34414

Publication date 7 June 2023

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user clicks in precise locations immediately before navigating to a site with a certificate error and made the renderer extremely busy at the same time, it could create a gap between when the error page was loaded and when the display actually refreshed. With the right timing the elicited clicks could land in that gap and activate the button that overrides the certificate error for that site. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
firefox	23.04 lunar	Not affected
	22.10 kinetic	Not affected
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Fixed 114.0+build3-0ubuntu0.20.04.1
	18.04 LTS bionic	Ignored
	16.04 LTS xenial	Ignored
	14.04 LTS trusty	Ignored
thunderbird	23.04 lunar	Fixed 1:102.13.0+build1-0ubuntu0.23.04.1
	22.10 kinetic	Fixed 1:102.13.0+build1-0ubuntu0.22.10.1
	22.04 LTS jammy	Fixed 1:102.13.0+build1-0ubuntu0.22.04.1
	20.04 LTS focal	Fixed 1:102.13.0+build1-0ubuntu0.20.04.1
	18.04 LTS bionic	Ignored
	16.04 LTS xenial	Ignored
	14.04 LTS trusty	Ignored

Notes

tyhicks

mozjs contains a copy of the SpiderMonkey JavaScript engine

mdeslaur

starting with Ubuntu 22.04, the firefox package is just a script that installs the Firefox snap

Severity score breakdown

Parameter	Value
Base score	3.1 · Low
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	Low
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L