CVE-2024-1550

Published: 20 February 2024

A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.

Notes

Author	Note
tyhicks	mozjs contains a copy of the SpiderMonkey JavaScript engine
mdeslaur	starting with Ubuntu 22.04, the firefox package is just a script that installs the Firefox snap

Priority

Status

Package	Release	Status
firefox Launchpad, Ubuntu, Debian	bionic	Ignored (end of standard support)
	focal	Released (123.0+build3-0ubuntu0.20.04.1)
	jammy	Not vulnerable (code not present)
	mantic	Not vulnerable (code not present)
	noble	Not vulnerable (code not present)
	trusty	Ignored (end of standard support)
	upstream	Needs triage
	xenial	Ignored (end of standard support)
mozjs102 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Needs triage
	mantic	Needs triage
	noble	Needs triage
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
mozjs38 Launchpad, Ubuntu, Debian	bionic	Needs triage
	focal	Does not exist
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
mozjs52 Launchpad, Ubuntu, Debian	bionic	Needs triage
	focal	Needs triage
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
mozjs68 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Needs triage
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
mozjs78 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Needs triage
	mantic	Does not exist
	noble	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
mozjs91 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Needs triage
	mantic	Does not exist
	noble	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
thunderbird Launchpad, Ubuntu, Debian	bionic	Ignored (end of standard support)
	focal	Released (1:115.8.1+build1-0ubuntu0.20.04.1)
	jammy	Released (1:115.8.1+build1-0ubuntu0.22.04.1)
	mantic	Released (1:115.8.1+build1-0ubuntu0.23.10.1)
	noble	Needed
	trusty	Ignored (end of standard support)
	upstream	Needs triage
	xenial	Ignored (end of standard support)

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›