Skip to content
OpenAdvisories
Critical USN-5504-1 17 CVEs

firefox vulnerabilities

Published Jul 5, 2022 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, spoof the
browser UI, bypass CSP restrictions, bypass sandboxed iframe restrictions,
obtain sensitive information, bypass the HTML sanitizer, or execute
arbitrary code. (CVE-2022-2200, CVE-2022-34468, CVE-2022-34470,
CVE-2022-34473, CVE-2022-34474, CVE-2022-34475, CVE-2022-34476,
CVE-2022-34477, CVE-2022-34479, CVE-2022-34480, CVE-2022-34481,
CVE-2022-34484, CVE-2022-34485)

It was discovered that Firefox could be made to save an image with an
executable extension in the filename when dragging and dropping an image
in some circumstances. If a user were tricked into dragging and dropping
a specially crafted image, an attacker could potentially exploit this to
trick the user into executing arbitrary code. (CVE-2022-34482,
CVE-2022-34483)

It was discovered that a compromised server could trick Firefox into an
addon downgrade in some circumstances. An attacker could potentially
exploit this to trick the browser into downgrading an addon to a prior
version. (CVE-2022-34471)

It was discovered that an unavailable PAC file caused OCSP requests to
be blocked, resulting in incorrect error pages being displayed.
(CVE-2022-34472)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS firefox 102.0+build2-0ubuntu0.18.04.1
Ubuntu · 20.04 LTS 20.04:LTS firefox 102.0+build2-0ubuntu0.20.04.1

Vulnerabilities 17

References

  • report
    https://ubuntu.com/security/CVE-2022-2200
  • report
    https://ubuntu.com/security/CVE-2022-34468
  • report
    https://ubuntu.com/security/CVE-2022-34470
  • report
    https://ubuntu.com/security/CVE-2022-34471
  • report
    https://ubuntu.com/security/CVE-2022-34472
  • report
    https://ubuntu.com/security/CVE-2022-34473
  • report
    https://ubuntu.com/security/CVE-2022-34474
  • report
    https://ubuntu.com/security/CVE-2022-34475
  • report
    https://ubuntu.com/security/CVE-2022-34476
  • report
    https://ubuntu.com/security/CVE-2022-34477
  • report
    https://ubuntu.com/security/CVE-2022-34479
  • report
    https://ubuntu.com/security/CVE-2022-34480
  • report
    https://ubuntu.com/security/CVE-2022-34481
  • report
    https://ubuntu.com/security/CVE-2022-34482
  • report
    https://ubuntu.com/security/CVE-2022-34483
  • report
    https://ubuntu.com/security/CVE-2022-34484
  • report
    https://ubuntu.com/security/CVE-2022-34485