Summary
Multiple security issues were discovered in Firefox. If a user were tricked
into opening a specially crafted website, an attacker could potentially
exploit these to cause a denial of service, spoof the contents of the
addressbar, bypass security restrictions, cross-site tracing or execute
arbitrary code. (CVE-2022-45403, CVE-2022-45404, CVE-2022-45405,
CVE-2022-45406, CVE-2022-45407, CVE-2022-45408, CVE-2022-45409, CVE-2022-45410,
CVE-2022-45411, CVE-2022-45413, CVE-2022-40674, CVE-2022-45418, CVE-2022-45419,
CVE-2022-45420, CVE-2022-45421)
Armin Ebert discovered that Firefox did not properly manage while resolving
file symlink. If a user were tricked into opening a specially crafted weblink,
an attacker could potentially exploit these to cause a denial of service.
(CVE-2022-45412)
Jefferson Scher and Jayateertha Guruprasad discovered that Firefox did not
properly sanitize the HTML download file extension under certain circumstances.
If a user were tricked into downloading and executing malicious content, a
remote attacker could execute arbitrary code with the privileges of the user
invoking the programs. (CVE-2022-45415)
Erik Kraft, Martin Schwarzl, and Andrew McCreight discovered that Firefox
incorrectly handled keyboard events. An attacker could possibly use this
issue to perform a timing side-channel attack and possibly figure out which
keys are being pressed. (CVE-2022-45416)
Kagami discovered that Firefox did not detect Private Browsing Mode correctly.
An attacker could possibly use this issue to obtain sensitive information about
Private Browsing Mode.
(CVE-2022-45417)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 107.0+build2-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | firefox | 107.0+build2-0ubuntu0.20.04.1 |
Vulnerabilities 19
-
Critical 9.8
If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while refer…
-
High 8.8
The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> …
-
High 8.8
When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlin…
-
High 8.8
Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some …
-
High 8.1
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.
-
High 7.8
When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox…
-
High 7.5
If an attacker loaded a font using <code>FontFace()</code> on a background worker, a use-after-free could have occurred…
-
Medium 6.5
Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for…
-
Medium 6.5
Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen withou…
-
Medium 6.5
Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free …
-
Medium 6.5
Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seei…
-
Medium 6.5
When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the S…
-
Medium 6.5
Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timin…
-
Medium 6.5
If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server t…
-
Medium 6.5
Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of …
-
Medium 6.1
Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access…
-
Medium 6.1
Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause…
-
Medium 6.1
If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the bro…
-
Medium 4.3
Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers be…
References
-
report
https://ubuntu.com/security/CVE-2022-40674
-
report
https://ubuntu.com/security/CVE-2022-45403
-
report
https://ubuntu.com/security/CVE-2022-45404
-
report
https://ubuntu.com/security/CVE-2022-45405
-
report
https://ubuntu.com/security/CVE-2022-45406
-
report
https://ubuntu.com/security/CVE-2022-45407
-
report
https://ubuntu.com/security/CVE-2022-45408
-
report
https://ubuntu.com/security/CVE-2022-45409
-
report
https://ubuntu.com/security/CVE-2022-45410
-
report
https://ubuntu.com/security/CVE-2022-45411
-
report
https://ubuntu.com/security/CVE-2022-45412
-
report
https://ubuntu.com/security/CVE-2022-45413
-
report
https://ubuntu.com/security/CVE-2022-45415
-
report
https://ubuntu.com/security/CVE-2022-45416
-
report
https://ubuntu.com/security/CVE-2022-45417
-
report
https://ubuntu.com/security/CVE-2022-45418
-
report
https://ubuntu.com/security/CVE-2022-45419
-
report
https://ubuntu.com/security/CVE-2022-45420
-
report
https://ubuntu.com/security/CVE-2022-45421