Summary
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, spoof the
browser UI, bypass permission prompts, obtain sensitive information,
bypass security restrictions, or execute arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 100.0+build2-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | firefox | 100.0+build2-0ubuntu0.20.04.1 |
Vulnerabilities 8
-
Critical 9.8
Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bu…
-
High 8.8
Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level orig…
-
High 8.8
Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in F…
-
Medium 6.5
When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have …
-
Medium 6.5
Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. Th…
-
Medium 6.1
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could…
-
Medium 6.1
Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affe…
-
Medium 4.3
The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This…
References
-
report
https://ubuntu.com/security/CVE-2022-29909
-
report
https://ubuntu.com/security/CVE-2022-29911
-
report
https://ubuntu.com/security/CVE-2022-29912
-
report
https://ubuntu.com/security/CVE-2022-29914
-
report
https://ubuntu.com/security/CVE-2022-29915
-
report
https://ubuntu.com/security/CVE-2022-29916
-
report
https://ubuntu.com/security/CVE-2022-29917
-
report
https://ubuntu.com/security/CVE-2022-29918