Red Hat Security Advisory: firefox security update

Fixed packages 3

Vulnerabilities 7

• High 8.8
  CVE-2022-40962

  Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team report…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-40957

  Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-40958

  By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-40959

  During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that lea…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-40960

  Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.1
  CVE-2022-40956

  When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected ele…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 5.5
  CVE-2022-3266

  An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnera…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2128792
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2128793
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2128794
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2128795
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2128796
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2128797
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6703.json
• report
  https://access.redhat.com/security/cve/CVE-2022-3266
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2157739
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3266
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3266
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/#CVE-2022-3266
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-42/#CVE-2022-3266
• report
  https://access.redhat.com/security/cve/CVE-2022-40956
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40956
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40956
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/#CVE-2022-40956
• report
  https://access.redhat.com/security/cve/CVE-2022-40957
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40957
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40957
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/#CVE-2022-40957
• report
  https://access.redhat.com/security/cve/CVE-2022-40958
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40958
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40958
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/#CVE-2022-40958
• report
  https://access.redhat.com/security/cve/CVE-2022-40959
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40959
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40959
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/#CVE-2022-40959
• report
  https://access.redhat.com/security/cve/CVE-2022-40960
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40960
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40960
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/#CVE-2022-40960
• report
  https://access.redhat.com/security/cve/CVE-2022-40962
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40962
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40962
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/#CVE-2022-40962