Summary
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, bypass Content
Security Policy (CSP) or other security restrictions, conduct session
fixation attacks, or execute arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 105.0+build2-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | firefox | 105.0+build2-0ubuntu0.20.04.1 |
Vulnerabilities 7
-
High 8.8
Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team report…
-
Medium 6.5
Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<…
-
Medium 6.5
By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context …
-
Medium 6.5
During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that lea…
-
Medium 6.5
Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a…
-
Medium 6.1
When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected ele…
-
Medium 5.5
An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnera…
References
-
report
https://ubuntu.com/security/CVE-2022-3266
-
report
https://ubuntu.com/security/CVE-2022-40956
-
report
https://ubuntu.com/security/CVE-2022-40957
-
report
https://ubuntu.com/security/CVE-2022-40958
-
report
https://ubuntu.com/security/CVE-2022-40959
-
report
https://ubuntu.com/security/CVE-2022-40960
-
report
https://ubuntu.com/security/CVE-2022-40962