Summary
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, spoof the browser
UI, bypass security restrictions, obtain sensitive information across
domains, or execute arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 96.0+build2-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | firefox | 96.0+build2-0ubuntu0.20.04.1 |
Vulnerabilities 13
-
Critical 9.8
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability af…
-
High 8.8
Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow c…
-
High 8.8
Certain network request objects were freed too early when releasing a network request handle. This could have lead to a…
-
High 8.8
Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon…
-
High 8.8
Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these …
-
High 7.5
Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could h…
-
High 7.5
When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. …
-
Medium 6.5
Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This…
-
Medium 6.5
When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potent…
-
Medium 6.5
Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerab…
-
Medium 6.5
After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have l…
-
Medium 6.5
Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handli…
-
Medium 4.3
When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made th…
References
-
report
https://ubuntu.com/security/CVE-2021-4140
-
report
https://ubuntu.com/security/CVE-2022-22737
-
report
https://ubuntu.com/security/CVE-2022-22738
-
report
https://ubuntu.com/security/CVE-2022-22739
-
report
https://ubuntu.com/security/CVE-2022-22740
-
report
https://ubuntu.com/security/CVE-2022-22741
-
report
https://ubuntu.com/security/CVE-2022-22742
-
report
https://ubuntu.com/security/CVE-2022-22743
-
report
https://ubuntu.com/security/CVE-2022-22745
-
report
https://ubuntu.com/security/CVE-2022-22747
-
report
https://ubuntu.com/security/CVE-2022-22748
-
report
https://ubuntu.com/security/CVE-2022-22751
-
report
https://ubuntu.com/security/CVE-2022-22752