Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 8

• Critical 9.6
  CVE-2022-26384

  If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scr…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-0843

  Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 9…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-26381

  An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially explo…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 7.5
  CVE-2022-26387

  When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-26385

  In unusual circumstances, an individual thread may outlive the thread's manager during shutdown. This could have led to…

  Mozilla Firefox firefox librewolf Browsers Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-26386

  Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>…

  Mozilla Thunderbird Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 4.3
  CVE-2022-26382

  While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page f…

  Mozilla Firefox firefox librewolf Browsers Ubuntu Alpine
  Dec 22, 2022
• Medium 4.3
  CVE-2022-26383

  When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022

Revision history

1. 2023-01-01 #13

   PoC aufgenommen

2. 2022-08-14 #12

   Neue Updates von Gentoo aufgenommen

3. 2022-04-27 #11

   Neue Updates von Amazon aufgenommen

4. 2022-04-18 #10

   Neue Updates von IGEL aufgenommen

5. 2022-03-24 #9

   Neue Updates von Ubuntu aufgenommen

6. 2022-03-23 #8

   Neue Updates von Ubuntu aufgenommen

7. 2022-03-21 #7

   Neue Updates von SUSE und Debian aufgenommen

8. 2022-03-17 #6

   Neue Updates von Ubuntu aufgenommen

9. 2022-03-14 #5

   Neue Updates von SUSE, Red Hat und Oracle Linux aufgenommen

10. 2022-03-13 #4

    Neue Updates von Oracle Linux und SUSE aufgenommen

11. 2022-03-10 #3

    Neue Updates von Red Hat und Ubuntu aufgenommen

12. 2022-03-09 #2

    Thunderbird aufgenommen

13. 2022-03-08 #1

    Initiale Fassung

References

• Mozilla Bugzilla abgerufen am 2023-01-01
  https://bugzilla.mozilla.org/show_bug.cgi?id=1741888
• Mozilla Security Advisory vom 2022-03-08
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-10/
• Mozilla Security Advisory vom 2022-03-08
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-11/
• Mozilla Security Advisory vom 2022-03-08
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-12/
• Debian Security Advisory DSA-5097 vom 2022-03-09
  https://lists.debian.org/debian-security-announce/2022/msg00064.html
• Debian Security Advisory DLA-2942 vom 2022-03-10
  https://lists.debian.org/debian-lts-announce/2022/03/msg00013.html
• Red Hat Security Advisory RHSA-2022:0817 vom 2022-03-10
  https://access.redhat.com/errata/RHSA-2022:0817
• Red Hat Security Advisory RHSA-2022:0815 vom 2022-03-10
  https://access.redhat.com/errata/RHSA-2022:0815
• Red Hat Security Advisory RHSA-2022:0816 vom 2022-03-10
  https://access.redhat.com/errata/RHSA-2022:0816
• Red Hat Security Advisory RHSA-2022:0824 vom 2022-03-10
  https://access.redhat.com/errata/RHSA-2022:0824
• Ubuntu Security Notice USN-5321-1 vom 2022-03-10
  https://ubuntu.com/security/notices/USN-5321-1
• Red Hat Security Advisory RHSA-2022:0818 vom 2022-03-10
  https://access.redhat.com/errata/RHSA-2022:0818
• Oracle Linux Security Advisory ELSA-2022-0818 vom 2022-03-11
  http://linux.oracle.com/errata/ELSA-2022-0818.html
• Oracle Linux Security Advisory ELSA-2022-0824 vom 2022-03-11
  http://linux.oracle.com/errata/ELSA-2022-0824.html
• SUSE Security Update SUSE-SU-2022:14906-1 vom 2022-03-11
  https://lists.suse.com/pipermail/sle-security-updates/2022-March/010417.html
• SUSE Security Update SUSE-SU-2022:0822-1 vom 2022-03-14
  https://lists.suse.com/pipermail/sle-security-updates/2022-March/010434.html
• Red Hat Security Advisory RHSA-2022:0847 vom 2022-03-14
  https://access.redhat.com/errata/RHSA-2022:0847
• Red Hat Security Advisory RHSA-2022:0845 vom 2022-03-14
  https://access.redhat.com/errata/RHSA-2022:0845
• Red Hat Security Advisory RHSA-2022:0843 vom 2022-03-14
  https://access.redhat.com/errata/RHSA-2022:0843
• Red Hat Security Advisory RHSA-2022:0850 vom 2022-03-14
  https://access.redhat.com/errata/RHSA-2022:0850
• SUSE Security Update SUSE-SU-2022:0819-1 vom 2022-03-14
  https://lists.suse.com/pipermail/sle-security-updates/2022-March/010426.html
• Red Hat Security Advisory RHSA-2022:0853 vom 2022-03-14
  https://access.redhat.com/errata/RHSA-2022:0853
• SUSE Security Update SUSE-SU-2022:0821-1 vom 2022-03-14
  https://lists.suse.com/pipermail/sle-security-updates/2022-March/010433.html
• Oracle Linux Security Advisory ELSA-2022-0850 vom 2022-03-14
  http://linux.oracle.com/errata/ELSA-2022-0850.html
• Oracle Linux Security Advisory ELSA-2022-0845 vom 2022-03-14
  http://linux.oracle.com/errata/ELSA-2022-0845.html
• Ubuntu Security Notice USN-5321-2 vom 2022-03-17
  https://ubuntu.com/security/notices/USN-5321-2
• SUSE Security Update SUSE-SU-2022:0906-1 vom 2022-03-21
  https://lists.suse.com/pipermail/sle-security-updates/2022-March/010487.html
• Debian Security Advisory DSA-5106 vom 2022-03-21
  https://lists.debian.org/debian-security-announce/2022/msg00074.html
• Debian Security Advisory DLA-2961 vom 2022-03-22
  https://lists.debian.org/debian-lts-announce/2022/03/msg00034.html
• Ubuntu Security Notice USN-5345-1 vom 2022-03-24
  https://ubuntu.com/security/notices/USN-5345-1
• Ubuntu Security Notice USN-5321-3 vom 2022-03-24
  https://ubuntu.com/security/notices/USN-5321-3
• IGEL Security Notice ISN-2022-10 vom 2022-04-19
  https://kb.igel.com/securitysafety/en/isn-2022-10-firefox-vulnerabilities-57339298.html
• Amazon Linux Security Advisory ALAS-2022-1779 vom 2022-04-27
  https://alas.aws.amazon.com/AL2/ALAS-2022-1779.html
• Gentoo Linux Security Advisory GLSA-202208-14 vom 2022-08-14
  https://security.gentoo.org/glsa/202208-14