The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user clicks in precise locations immediately before navigating to a site with a certificate error and made the renderer extremely busy at the same time, it could create a gap between when the error page was loaded and when the display actually refreshed. With the right timing the elicited clicks could land in that gap and activate the button that overrides the certificate error for that site. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade thunderbirdUpgrade firefox-x11Upgrade firefox | Jun 22, 2023 | Jun 19, 2023 |
| Alpine Linux | — | Upgrade firefox-esrUpgrade firefoxUpgrade thunderbird | Aug 22, 2024 | Jun 19, 2023 |
| Amazon Linux Ami 2 | — | Upgrade firefoxUpgrade firefox-debuginfo | Sep 28, 2023 | Jun 19, 2023 |
| Centos_linux | — | Upgrade thunderbirdUpgrade firefoxUpgrade firefox-debuginfoUpgrade thunderbird-debuginfo | Jun 15, 2023 | Jun 12, 2023 |
| Debian | — | Upgrade thunderbirdUpgrade firefox-esr | Jun 9, 2023 | Jun 9, 2023 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade mail-client/thunderbird-bin.Upgrade www-client/firefox-bin.Upgrade mail-client/thunderbird. | Dec 21, 2023 | Jun 19, 2023 |
| Mfsa2023 19 | — | Upgrade to Mozilla Firefox ESR version 102.12Upgrade to the latest version of Mozilla Firefox | Jun 7, 2023 | Jun 6, 2023 |
| Mfsa2023 20 | — | Upgrade to Mozilla Firefox version 114.0Upgrade to the latest version of Mozilla Firefox | Jun 7, 2023 | Jun 6, 2023 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 102.12Upgrade to the latest version of Mozilla Thunderbird | Jun 12, 2023 | Jun 7, 2023 |
| Oracle_linux | — | Upgrade thunderbirdUpgrade firefoxUpgrade firefox-x11 | May 21, 2024 | Jun 6, 2023 |
| Redhat_linux | — | Upgrade firefoxNo solution existsUpgrade thunderbird-debugsourceUpgrade firefox-x11Upgrade thunderbird-debuginfoUpgrade firefox-debuginfoUpgrade thunderbirdUpgrade firefox-debugsource | Jun 15, 2023 | Jun 12, 2023 |
| Rocky_linux | — | Upgrade thunderbird-debugsourceUpgrade firefoxUpgrade thunderbirdUpgrade firefox-debugsourceUpgrade firefox-debuginfoUpgrade thunderbird-debuginfo | Mar 5, 2024 | Jun 19, 2023 |
| Suse | — | Upgrade MozillaThunderbird-translations-otherUpgrade MozillaFirefox-translations-otherUpgrade MozillaFirefox-develUpgrade MozillaThunderbird-translations-commonUpgrade MozillaFirefox-translations-commonUpgrade MozillaThunderbirdUpgrade MozillaFirefoxUpgrade mozillafirefox-branding-upstream | Jun 8, 2023 | Jun 7, 2023 |
| Ubuntu | — | Upgrade firefoxUpgrade thunderbird | Jun 8, 2023 | Jun 7, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 19, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub