Summary
A use-after-free was discovered when removing an XSLT parameter in some
circumstances. If a user were tricked into opening a specially crafted
website, an attacker could exploit this to cause a denial of service, or
execute arbitrary code. (CVE-2022-26485)
A use-after-free was discovered in the WebGPU IPC framework. If a user
were tricked into opening a specially crafted website, an attacker could
exploit this to cause a denial of service, or execute arbitrary code.
(CVE-2022-26486)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 97.0.2+build1-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | firefox | 97.0.2+build1-0ubuntu0.20.04.1 |
Vulnerabilities 2
-
Critical 9.6CVE-2022-26486 Exploited
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We hav…
KEV Mar 7, 2022 -
High 8.8
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…
KEV Mar 7, 2022