CVE-2023-29549
Fixed in a distro release EPSS <1%CVSS 6.5
Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vulnerability relating to JavaScript-implemented sandboxes such as SES. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Products: Mozilla Firefox for Android, Mozilla Firefox, Mozilla Focus for Android
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu 18.04 LTS | firefox | 112.0+build2-0ubuntu0.18.04.1 |
| Ubuntu 18.04 LTS | mozjs38 | no fix |
| Ubuntu 18.04 LTS | mozjs52 | no fix |
| Ubuntu 20.04 LTS | firefox | 112.0+build2-0ubuntu0.20.04.1 |
| Ubuntu 20.04 LTS | mozjs52 | no fix |
| Ubuntu 20.04 LTS | mozjs68 | no fix |
| Ubuntu 22.04 LTS | mozjs78 | no fix |
| Ubuntu 22.04 LTS | mozjs91 | no fix |
| openSUSE Tumbleweed | MozillaFirefox | 112.0.1-1.1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 |