Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 18

• Critical 9.8
  CVE-2021-4140

  It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability af…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-22738

  Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow c…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-22740

  Certain network request objects were freed too early when releasing a network request handle. This could have lead to a…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-22744

  The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-22751

  Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-22752

  Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these …

  Mozilla Firefox firefox librewolf Browsers Ubuntu Alpine
  Dec 22, 2022
• High 7.5
  CVE-2022-22737

  Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could h…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 7.5
  CVE-2022-22741

  When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 7.0
  CVE-2022-22736

  If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched …

  Mozilla Firefox librewolf firefox Browsers Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-22739

  Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-22742

  When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potent…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-22745

  Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerab…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-22747

  After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have l…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-22748

  Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handli…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-22750

  By generally accepting and passing resource handles across processes, a compromised content process might have confused…

  Mozilla Firefox librewolf firefox Browsers Alpine
  Dec 22, 2022
• Medium 5.9
  CVE-2022-22746

  A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Dec 22, 2022
• Medium 4.3
  CVE-2022-22743

  When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made th…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 4.3
  CVE-2022-22749

  When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content…

  Mozilla Firefox firefox librewolf Browsers Alpine
  Dec 22, 2022

Revision history

1. 2023-02-15 #15

   Neue Updates von Ubuntu aufgenommen

2. 2022-08-14 #14

   Neue Updates von Gentoo aufgenommen

3. 2022-07-14 #13

   Neue Updates von Amazon aufgenommen

4. 2022-07-07 #12

   Neue Updates von Ubuntu aufgenommen

5. 2022-03-08 #11

   Neue Updates von Amazon aufgenommen

6. 2022-02-21 #10

   Neue Updates von Gentoo aufgenommen

7. 2022-01-26 #9

   Neue Updates von SUSE aufgenommen

8. 2022-01-25 #8

   Neue Updates von Debian und SUSE aufgenommen

9. 2022-01-23 #7

   Neue Updates von Ubuntu aufgenommen

10. 2022-01-20 #6

    Neue Updates von SUSE aufgenommen

11. 2022-01-18 #5

    Neue Updates von SUSE und CentOS aufgenommen

12. 2022-01-16 #4

    Neue Updates von Debian aufgenommen

13. 2022-01-13 #3

    Neue Updates von Ubuntu aufgenommen

14. 2022-01-12 #2

    Neue Updates von Red Hat und Oracle Linux aufgenommen

15. 2022-01-11 #1

    Initiale Fassung

References

• Ubuntu Security Notice USN-5872-1 vom 2023-02-15
  https://ubuntu.com/security/notices/USN-5872-1
• Mozilla 96 Releasenotes vom 2022-01-11
  https://www.mozilla.org/en-US/firefox/96.0/releasenotes/
• Mozilla Advisory MFSA 2022-01 vom 2022-01-11
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-01/
• Mozilla Advisory MFSA 2022-02 vom 2022-01-11
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-02/
• Mozilla Advisory MFSA 2022-03 vom 2022-01-11
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-03/
• Red Hat Security Advisory RHSA-2022:0131 vom 2022-01-13
  https://access.redhat.com/errata/RHSA-2022:0131
• Red Hat Security Advisory RHSA-2022:0123 vom 2022-01-13
  https://access.redhat.com/errata/RHSA-2022:0123
• Oracle Linux Security Advisory ELSA-2022-0127 vom 2022-01-13
  http://linux.oracle.com/errata/ELSA-2022-0127.html
• Oracle Linux Security Advisory ELSA-2022-0129 vom 2022-01-13
  http://linux.oracle.com/errata/ELSA-2022-0129.html
• Oracle Linux Security Advisory ELSA-2022-0130 vom 2022-01-13
  http://linux.oracle.com/errata/ELSA-2022-0130.html
• Red Hat Security Advisory RHSA-2022:0130 vom 2022-01-13
  https://access.redhat.com/errata/RHSA-2022:0130
• Oracle Linux Security Advisory ELSA-2022-0124 vom 2022-01-13
  http://linux.oracle.com/errata/ELSA-2022-0124.html
• Red Hat Security Advisory RHSA-2022:0129 vom 2022-01-13
  https://access.redhat.com/errata/RHSA-2022:0129
• Red Hat Security Advisory RHSA-2022:0127 vom 2022-01-13
  https://access.redhat.com/errata/RHSA-2022:0127
• Red Hat Security Advisory RHSA-2022:0124 vom 2022-01-13
  https://access.redhat.com/errata/RHSA-2022:0124
• Red Hat Security Advisory RHSA-2022:0132 vom 2022-01-13
  https://access.redhat.com/errata/RHSA-2022:0132
• Red Hat Security Advisory RHSA-2022:0125 vom 2022-01-13
  https://access.redhat.com/errata/RHSA-2022:0125
• Red Hat Security Advisory RHSA-2022:0126 vom 2022-01-13
  https://access.redhat.com/errata/RHSA-2022:0126
• Red Hat Security Advisory RHSA-2022:0128 vom 2022-01-13
  https://access.redhat.com/errata/RHSA-2022:0128
• Ubuntu Security Notice USN-5229-1 vom 2022-01-14
  https://ubuntu.com/security/notices/USN-5229-1
• Debian Security Advisory DLA-2880 vom 2022-01-16
  https://lists.debian.org/debian-lts-announce/2022/01/msg00007.html
• Debian Security Advisory DLA-2881 vom 2022-01-16
  https://lists.debian.org/debian-lts-announce/2022/01/msg00008.html
• Debian Security Advisory DSA-5044 vom 2022-01-14
  https://www.debian.org/security/2022/dsa-5044
• Debian Security Advisory DSA-5045 vom 2022-01-15
  https://www.debian.org/security/2022/dsa-5045
• SUSE Security Update SUSE-SU-2022:0115-1 vom 2022-01-18
  https://lists.suse.com/pipermail/sle-security-updates/2022-January/010018.html
• CentOS Security Advisory CESA-2022:0124 vom 2022-01-18
  https://lists.centos.org/pipermail/centos-announce/2022-January/073536.html
• CentOS Security Advisory CESA-2022:0127 vom 2022-01-18
  https://lists.centos.org/pipermail/centos-announce/2022-January/073537.html
• SUSE Security Update SUSE-SU-2022:0136-1 vom 2022-01-20
  https://lists.suse.com/pipermail/sle-security-updates/2022-January/010034.html
• SUSE Security Update SUSE-SU-2022:0137-1 vom 2022-01-20
  https://lists.suse.com/pipermail/sle-security-updates/2022-January/010035.html
• Ubuntu Security Notice USN-5246-1 vom 2022-01-21
  https://ubuntu.com/security/notices/USN-5246-1
• Ubuntu Security Notice USN-5248-1 vom 2022-01-21
  https://ubuntu.com/security/notices/USN-5248-1
• Debian Security Advisory DLA-2898 vom 2022-01-25
  https://lists.debian.org/debian-lts-announce/2022/01/msg00025.html
• SUSE Security Update SUSE-SU-2022:14880-1 vom 2022-01-25
  https://lists.suse.com/pipermail/sle-security-updates/2022-January/010062.html
• Debian Security Advisory DSA-5062 vom 2022-01-25
  https://lists.debian.org/debian-security-announce/2022/msg00028.html
• SUSE Security Update SUSE-SU-2022:0199-1 vom 2022-01-26
  https://lists.suse.com/pipermail/sle-security-updates/2022-January/010081.html
• Gentoo Linux Security Advisory GLSA-202202-03 vom 2022-02-22
  https://security.gentoo.org/glsa/202202-03
• Amazon Linux Security Advisory ALAS-2022-1763 vom 2022-03-09
  https://alas.aws.amazon.com/AL2/ALAS-2022-1763.html
• Ubuntu Security Notice USN-5506-1 vom 2022-07-07
  https://ubuntu.com/security/notices/USN-5506-1
• Amazon Linux Security Advisory ALAS-2022-1818 vom 2022-07-15
  https://alas.aws.amazon.com/AL2/ALAS-2022-1818.html
• Gentoo Linux Security Advisory GLSA-202208-14 vom 2022-08-14
  https://security.gentoo.org/glsa/202208-14