CVE-2023-29547
Fixed in a distro release EPSS <1%CVSS 6.5
When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have silently failed. This could have led to a desynchronization in expected results when reading from the secure cookie. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Products: Mozilla Firefox for Android, Mozilla Firefox, Mozilla Focus for Android
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu 18.04 LTS | firefox | 112.0+build2-0ubuntu0.18.04.1 |
| Ubuntu 18.04 LTS | mozjs38 | no fix |
| Ubuntu 18.04 LTS | mozjs52 | no fix |
| Ubuntu 20.04 LTS | firefox | 112.0+build2-0ubuntu0.20.04.1 |
| Ubuntu 20.04 LTS | mozjs52 | no fix |
| Ubuntu 20.04 LTS | mozjs68 | no fix |
| Ubuntu 22.04 LTS | mozjs78 | no fix |
| Ubuntu 22.04 LTS | mozjs91 | no fix |
| openSUSE Tumbleweed | MozillaFirefox | 112.0.1-1.1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 |