CVE-2023-29540
Fixed in a distro release EPSS <1%
Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without <code>allow-top-navigation-to-custom-protocols</code>. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Products: Mozilla Firefox for Android, Mozilla Firefox, Mozilla Focus for Android
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu 18.04 LTS | firefox | 112.0+build2-0ubuntu0.18.04.1 |
| Ubuntu 18.04 LTS | mozjs38 | no fix |
| Ubuntu 18.04 LTS | mozjs52 | no fix |
| Ubuntu 20.04 LTS | firefox | 112.0+build2-0ubuntu0.20.04.1 |
| Ubuntu 20.04 LTS | mozjs52 | no fix |
| Ubuntu 20.04 LTS | mozjs68 | no fix |
| Ubuntu 22.04 LTS | mozjs78 | no fix |
| Ubuntu 22.04 LTS | mozjs91 | no fix |
| openSUSE Tumbleweed | MozillaFirefox | 112.0.1-1.1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 |