QID 356258

firefox-esr , thunderbird and nss only are affected by this package. (
( CVE-2023-0767) the mozilla foundation security advisory describes this flaw as: the `content-security-policy-report-only` header could allow an attacker to leak a child iframes unredacted uri when interaction with that iframe triggers a redirect. (
( CVE-2023-25728) the mozilla foundation security advisory describes this flaw as: permission prompts for opening external schemes were only shown for `contentprincipals` resulting in extensions being able to open them without user interaction via `expandedprincipals`.
This could lead to further malicious actions such as downloading files or interacting with software already installed on the system. (
( CVE-2023-25729) the mozilla foundation security advisory describes this flaw as: a background script invoking `requestfullscreen` and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks. (
( CVE-2023-25730) due to url previews in the network panel of developer tools improperly storing urls, query parameters could potentially be used to overwrite global objects in privileged code. (
( CVE-2023-25731) when encoding data from an inputstream in xpcom the size of the input being encoded was not correctly calculated potentially leading to an out of bounds memory write. (
( CVE-2023-25732) the mozilla foundation security advisory describes this flaw as: after downloading a windows `.url` shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system.
Other operating systems are unaffected.* (

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.