DEBIAN-CVE-2023-5388

NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

References

https://security-tracker.debian.org/tracker/CVE-2023-5388

Affected packages

Debian:12

firefox-esr

Package

Name: firefox-esr
Purl: pkg:deb/debian/firefox-esr?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

115.9.0esr-1~deb12u1

Affected versions

102.*

102.11.0esr-1

102.12.0esr-1~deb10u1

102.12.0esr-1~deb11u1

102.12.0esr-1~deb12u1

102.12.0esr-1

102.13.0esr-1~deb10u1

102.13.0esr-1~deb11u1

102.13.0esr-1~deb12u1

102.13.0esr-1

102.14.0esr-1~deb10u1

102.14.0esr-1~deb11u1

102.14.0esr-1~deb12u1

102.15.0esr-1~deb10u1

102.15.0esr-1~deb11u1

102.15.0esr-1~deb12u1

102.15.1esr-1~deb10u1

102.15.1esr-1~deb11u1

102.15.1esr-1~deb12u1

115.*

115.0.2esr-1

115.1.0esr-1

115.2.0esr-1

115.2.1esr-1

115.3.0esr-1~deb10u1

115.3.0esr-1~deb11u1

115.3.0esr-1~deb12u1

115.3.0esr-1

115.3.1esr-1~deb10u1

115.3.1esr-1~deb11u1

115.4.0esr-1~deb10u1

115.4.0esr-1~deb11u1

115.4.0esr-1~deb12u1

115.4.0esr-1

115.5.0esr-1~deb10u1

115.5.0esr-1~deb11u1

115.5.0esr-1~deb12u1

115.5.0esr-1

115.6.0esr-1~deb10u1

115.6.0esr-1~deb11u1

115.6.0esr-1~deb12u1

115.6.0esr-1

115.7.0esr-1~deb10u1

115.7.0esr-1~deb11u1

115.7.0esr-1~deb12u1

115.7.0esr-1

115.8.0esr-1~deb10u1

115.8.0esr-1~deb11u1

115.8.0esr-1~deb12u1

115.8.0esr-1

115.9.0esr-1~deb11u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5388.json"

nss

Package

Name: nss
Purl: pkg:deb/debian/nss?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2:3.*

2:3.87.1-1

2:3.87.1-1+deb12u1

2:3.87.1-1+deb12u2

2:3.87.1-1+deb12u3

2:3.87.1-1+deb12u4

2:3.87.1-1+x32

2:3.89-1

2:3.89-2

2:3.90-1

2:3.90-2

2:3.90-3

2:3.91-1

2:3.92-1

2:3.93-1

2:3.94-1

2:3.95-1

2:3.96.1-1

2:3.98-1

2:3.99-1

2:3.100-1

2:3.101-1

2:3.102-1

2:3.103-1

2:3.105-1

2:3.105-2

2:3.106-1

2:3.107-1

2:3.108-1

2:3.109-1

2:3.110-1

2:3.111-1

2:3.112-1

2:3.114-1

2:3.116-1

2:3.117-1

2:3.119-1

2:3.120-1

2:3.121-1

2:3.123-1

2:3.123.1-1

2:3.124-1

2:3.126-1

2:3.127-1

2:3.128-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5388.json"

thunderbird

Package

Name: thunderbird
Purl: pkg:deb/debian/thunderbird?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1:115.9.0-1~deb12u1

Affected versions

1:102.*

1:102.11.0-1

1:102.12.0-1~deb10u1

1:102.12.0-1~deb11u1

1:102.12.0-1~deb12u1

1:102.12.0-1

1:102.13.0-1~deb10u1

1:102.13.0-1~deb11u1

1:102.13.0-1~deb12u1

1:102.13.0-1

1:102.13.1-1~deb10u1

1:102.13.1-1~deb11u1

1:102.13.1-1~deb12u1

1:102.13.1-1

1:102.14.0-1~deb10u1

1:102.14.0-1~deb11u1

1:102.14.0-1~deb12u1

1:102.15.0-1~deb10u1

1:102.15.0-1~deb11u1

1:102.15.0-1~deb12u1

1:102.15.1-1~deb10u1

1:102.15.1-1~deb11u1

1:102.15.1-1~deb12u1

1:103.*

1:103.0~b5-1

1:104.*

1:104.0~b2-1

1:110.*

1:110.0~b4-1

1:112.*

1:112.0~b1-1

1:113.*

1:113.0~b3-1

1:114.*

1:114.0~b2-1

1:115.*

1:115.0~b4-1

1:115.0~b6-1

1:115.0-1

1:115.0.1-1

1:115.0.1-2

1:115.1.0-1

1:115.1.1-1

1:115.2.0-1

1:115.2.2-1

1:115.3.0-1~deb12u1

1:115.3.0-1

1:115.3.1-1~deb10u1

1:115.3.1-1~deb11u1

1:115.3.1-1~deb12u1

1:115.3.1-1

1:115.4.1-1~deb10u1

1:115.4.1-1~deb11u1

1:115.4.1-1~deb12u1

1:115.4.1-1

1:115.5.0-1~deb10u1

1:115.5.0-1~deb11u1

1:115.5.0-1~deb12u1

1:115.5.0-1

1:115.5.1-1

1:115.5.2-1

1:115.6.0-1~deb10u1

1:115.6.0-1~deb11u1

1:115.6.0-1~deb12u1

1:115.6.0-1

1:115.7.0-1~deb10u1

1:115.7.0-1~deb11u1

1:115.7.0-1~deb12u1

1:115.7.0-1

1:115.8.0-1~deb10u1

1:115.8.0-1~deb11u1

1:115.8.0-1~deb12u1

1:115.8.0-1

1:115.8.1-1

1:115.9.0-1~deb10u1

1:115.9.0-1~deb11u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5388.json"

Debian:13

firefox-esr

Package

Name: firefox-esr
Purl: pkg:deb/debian/firefox-esr?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

115.9.0esr-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5388.json"

nss

Package

Name: nss
Purl: pkg:deb/debian/nss?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2:3.98-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5388.json"

thunderbird

Package

Name: thunderbird
Purl: pkg:deb/debian/thunderbird?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1:115.9.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5388.json"

Debian:14

firefox-esr

Package

Name: firefox-esr
Purl: pkg:deb/debian/firefox-esr?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

115.9.0esr-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5388.json"

nss

Package

Name: nss
Purl: pkg:deb/debian/nss?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2:3.98-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5388.json"

thunderbird

Package

Name: thunderbird
Purl: pkg:deb/debian/thunderbird?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1:115.9.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5388.json"