USN-5434-1 — firefox vulnerabilities

Summary

It was discovered that the methods of an Array object could be corrupted
as a result of prototype pollution by sending a message to the parent
process. If a user were tricked into opening a specially crafted website,
an attacker could exploit this to execute JavaScript in a privileged
context.

Fixed packages 2

Release	Package	Fixed in
Ubuntu · 18.04 LTS 18.04:LTS	firefox	100.0.2+build1-0ubuntu0.18.04.1
Ubuntu · 20.04 LTS 20.04:LTS	firefox	100.0.2+build1-0ubuntu0.20.04.1

Vulnerabilities 2

High 8.8

CVE-2022-1529 EPSS 18%

An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScr…

Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine

Dec 22, 2022
High 8.8

CVE-2022-1802 Public exploit EPSS 28%

If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could hav…

Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine

Dec 22, 2022

References

report
https://ubuntu.com/security/CVE-2022-1529
report
https://ubuntu.com/security/CVE-2022-1802

firefox vulnerabilities

Summary

Fixed packages 2

Vulnerabilities 2

An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScr…

If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could hav…

References