Red Hat Security Advisory: firefox security update

Fixed packages 3

Vulnerabilities 14

• Critical 9.8
  CVE-2022-45406

  If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while refer…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-45409

  The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-45412

  When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlin…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-45421

  Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 7.5
  CVE-2022-43680 Public exploit

  In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnt…

  thunderbird insighttoolkit4 expat swish-e Debian Ubuntu Azure Linux Alpine
  Oct 24, 2022
• Medium 6.5
  CVE-2022-45403

  Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-45404

  Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen withou…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-45405

  Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-45408

  Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seei…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-45410

  When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the S…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-45416

  Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timin…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-45420

  Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.1
  CVE-2022-45411

  Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.1
  CVE-2022-45418

  If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the bro…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2143197
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2143198
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2143199
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2143200
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2143201
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2143202
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2143203
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2143204
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2143205
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2143240
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2143241
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2143242
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2143243
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8553.json
• report
  https://access.redhat.com/security/cve/CVE-2022-43680
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2140059
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-43680
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-43680
• article
  https://github.com/libexpat/libexpat/issues/649
• report
  https://access.redhat.com/security/cve/CVE-2022-45403
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-45403
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-45403
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45403
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45403
• report
  https://access.redhat.com/security/cve/CVE-2022-45404
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-45404
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-45404
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45404
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45404
• report
  https://access.redhat.com/security/cve/CVE-2022-45405
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-45405
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-45405
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45405
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45405
• report
  https://access.redhat.com/security/cve/CVE-2022-45406
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-45406
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-45406
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45406