Mozilla Firefox, Mozilla Firefox ESR und Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 13

• High 8.8
  CVE-2022-28281 Public exploit

  If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent p…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-28284

  SVG's <code>&lt;use&gt;</code> element could have been used to load unexpected content that could have executed script …

  Mozilla Firefox firefox librewolf Browsers Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-28288

  Mozilla developers and community members Randell Jesup, Sebastian Hengst, and the Mozilla Fuzzing Team reported memory …

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-28289

  Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 7.5
  CVE-2022-24713 Public exploit EPSS 14%

  Regular expression denial of service in Rust's regex crate

  regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations…

  rust-lang regex thunderbird firefox Debian Ubuntu Azure Linux Alpine crates.io
  Mar 8, 2022
• Medium 6.5
  CVE-2022-1097

  <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on diffe…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-1196

  After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and pot…

  Mozilla Thunderbird Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-28282

  By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-28283

  The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to includ…

  Mozilla Firefox firefox firefox Browsers Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-28285

  When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conju…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-28287

  In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. …

  Mozilla Firefox firefox librewolf Browsers Ubuntu Alpine
  Dec 22, 2022
• Medium 5.4
  CVE-2022-1197

  When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the exi…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 5.4
  CVE-2022-28286

  Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user con…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022

Revision history

1. 2025-11-02 #16

   Neue Updates von SUSE aufgenommen

2. 2025-10-26 #15

   Neue Updates von SUSE aufgenommen

3. 2023-09-05 #14

   Neue Updates von SUSE aufgenommen

4. 2023-01-01 #13

   PoC aufgenommen

5. 2022-12-18 #12

   Neue Updates von Gentoo aufgenommen

6. 2022-09-13 #11

   Neue Updates von Ubuntu aufgenommen

7. 2022-08-14 #10

   Neue Updates von Gentoo aufgenommen

8. 2022-06-27 #9

   Neue Updates von Ubuntu aufgenommen

9. 2022-04-27 #8

   Neue Updates von Amazon und Ubuntu aufgenommen

10. 2022-04-13 #7

    Neue Updates von SUSE aufgenommen

11. 2022-04-12 #6

    Neue Updates von Red Hat aufgenommen

12. 2022-04-11 #5

    Neue Updates von Red Hat, SUSE und Debian aufgenommen

13. 2022-04-10 #4

    Neue Updates von Red Hat, Debian und Oracle Linux aufgenommen

14. 2022-04-07 #3

    Neue Updates von Ubuntu, Debian und SUSE aufgenommen

15. 2022-04-06 #2

    Neue Updates von Red Hat, Mozilla und Debian aufgenommen

16. 2022-04-05 #1

    Initiale Fassung

References

• Mozilla Security Advisory vom 2022-04-05
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-13/
• Mozilla Security Advisory vom 2022-04-05
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-14/
• SUSE Security Advisory vom 2022-04-05
  https://lists.suse.com/pipermail/sle-security-updates/2022-April/010659.html
• SUSE Security Advisory vom 2022-04-05
  https://lists.suse.com/pipermail/sle-security-updates/2022-April/010660.html
• Red Hat Bug-Tracker 2072559 vom 2022-04-06
  https://bugzilla.redhat.com/show_bug.cgi?id=2072559
• Mozilla Security Advisory MFSA2022-15 vom 2022-04-06
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-15/
• Red Hat Bug-Tracker 2072560 vom 2022-04-06
  https://bugzilla.redhat.com/show_bug.cgi?id=2072560
• Red Hat Bug-Tracker 2072562 vom 2022-04-06
  https://bugzilla.redhat.com/show_bug.cgi?id=2072562
• Red Hat Bug-Tracker 2072566 vom 2022-04-06
  https://bugzilla.redhat.com/show_bug.cgi?id=2072566
• Red Hat Bug-Tracker 2072561 vom 2022-04-06
  https://bugzilla.redhat.com/show_bug.cgi?id=2072561
• Red Hat Bug-Tracker 2072565 vom 2022-04-06
  https://bugzilla.redhat.com/show_bug.cgi?id=2072565
• Red Hat Bug-Tracker 2072564 vom 2022-04-06
  https://bugzilla.redhat.com/show_bug.cgi?id=2072564
• Debian Security Advisory DSA-5113 vom 2022-04-06
  https://lists.debian.org/debian-security-announce/2022/msg00081.html
• Red Hat Bug-Tracker 2072563 vom 2022-04-06
  https://bugzilla.redhat.com/show_bug.cgi?id=2072563
• Ubuntu Security Notice USN-5370-1 vom 2022-04-07
  https://ubuntu.com/security/notices/USN-5370-1
• Debian Security Advisory DLA-2971 vom 2022-04-07
  https://lists.debian.org/debian-lts-announce/2022/04/msg00003.html
• SUSE Security Update SUSE-SU-2022:1127-1 vom 2022-04-07
  https://lists.suse.com/pipermail/sle-security-updates/2022-April/010667.html
• Red Hat Security Advisory RHSA-2022:1285 vom 2022-04-08
  https://access.redhat.com/errata/RHSA-2022:1285
• Red Hat Security Advisory RHSA-2022:1286 vom 2022-04-08
  https://access.redhat.com/errata/RHSA-2022:1286
• Red Hat Security Advisory RHSA-2022:1287 vom 2022-04-08
  https://access.redhat.com/errata/RHSA-2022:1287
• Debian Security Advisory DSA-5118 vom 2022-04-10
  https://lists.debian.org/debian-security-announce/2022/msg00086.html
• Oracle Linux Security Advisory ELSA-2022-1284 vom 2022-04-08
  https://linux.oracle.com/errata/ELSA-2022-1284.html
• Oracle Linux Security Advisory ELSA-2022-1287 vom 2022-04-08
  https://linux.oracle.com/errata/ELSA-2022-1287.html
• Red Hat Security Advisory RHSA-2022:1283 vom 2022-04-08
  https://access.redhat.com/errata/RHSA-2022:1283
• Red Hat Security Advisory RHSA-2022:1284 vom 2022-04-08
  https://access.redhat.com/errata/RHSA-2022:1284
• Red Hat Security Advisory RHSA-2022:1301 vom 2022-04-11
  https://access.redhat.com/errata/RHSA-2022:1301
• Red Hat Security Advisory RHSA-2022:1302 vom 2022-04-11
  https://access.redhat.com/errata/RHSA-2022:1302
• SUSE Security Update SUSE-SU-2022:1149-1 vom 2022-04-11
  https://lists.suse.com/pipermail/sle-security-updates/2022-April/010677.html
• Red Hat Security Advisory RHSA-2022:1303 vom 2022-04-11
  https://access.redhat.com/errata/RHSA-2022:1303
• Red Hat Security Advisory RHSA-2022:1305 vom 2022-04-11
  https://access.redhat.com/errata/RHSA-2022:1305
• Debian Security Advisory DLA-2978 vom 2022-04-11
  https://lists.debian.org/debian-lts-announce/2022/04/msg00009.html
• Oracle Linux Security Advisory ELSA-2022-1302 vom 2022-04-12
  https://linux.oracle.com/errata/ELSA-2022-1302.html
• Oracle Linux Security Advisory ELSA-2022-1301 vom 2022-04-12
  https://linux.oracle.com/errata/ELSA-2022-1301.html
• Red Hat Security Advisory RHSA-2022:1326 vom 2022-04-12
  https://access.redhat.com/errata/RHSA-2022:1326
• SUSE Security Update SUSE-SU-2022:1176-1 vom 2022-04-13
  https://lists.suse.com/pipermail/sle-security-updates/2022-April/010699.html
• Amazon Linux Security Advisory ALAS-2022-1789 vom 2022-04-27
  https://alas.aws.amazon.com/AL2/ALAS-2022-1789.html
• Ubuntu Security Notice USN-5393-1 vom 2022-04-27
  https://ubuntu.com/security/notices/USN-5393-1
• Ubuntu Security Notice USN-5494-1 vom 2022-06-27
  https://ubuntu.com/security/notices/USN-5494-1
• Gentoo Linux Security Advisory GLSA-202208-14 vom 2022-08-14
  https://security.gentoo.org/glsa/202208-14
• Ubuntu Security Notice USN-5610-1 vom 2022-09-14
  https://ubuntu.com/security/notices/USN-5610-1
• Gentoo Linux Security Advisory GLSA-202212-05 vom 2022-12-19
  https://security.gentoo.org/glsa/202212-05
• Mozilla Bugzilla vom 2023-01-01
  https://bugzilla.mozilla.org/show_bug.cgi?id=1751609
• SUSE Security Update SUSE-SU-2023:3526-1 vom 2023-09-05
  https://lists.suse.com/pipermail/sle-security-updates/2023-September/016091.html
• SUSE Security Update SUSE-SU-2025:3786-1 vom 2025-10-24
  https://lists.suse.com/pipermail/sle-security-updates/2025-October/023004.html
• SUSE Security Update SUSE-SU-2025:3784-1 vom 2025-10-24
  https://lists.suse.com/pipermail/sle-security-updates/2025-October/023006.html
• SUSE Security Update SUSE-SU-2025:3783-1 vom 2025-10-24
  https://lists.suse.com/pipermail/sle-security-updates/2025-October/023007.html
• SUSE Security Update SUSE-SU-2025:3785-1 vom 2025-10-24
  https://lists.suse.com/pipermail/sle-security-updates/2025-October/023005.html
• SUSE Security Update SUSE-SU-2025:3911-1 vom 2025-11-03
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BISAFPBE5W3NQIBLDMNJRPF5MD72GTHM/
• SUSE Security Update SUSE-SU-2025:3911-1 vom 2025-11-03
  https://lists.suse.com/pipermail/sle-security-updates/2025-November/023135.html