Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 19

• Critical 9.8
  CVE-2022-45406

  If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while refer…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-45409

  The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-45412

  When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlin…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-45421

  Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.1
  CVE-2022-40674

  libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

  thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Sep 14, 2022
• High 7.8
  CVE-2022-45415

  When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Dec 22, 2022
• High 7.5
  CVE-2022-45407

  If an attacker loaded a font using <code>FontFace()</code> on a background worker, a use-after-free could have occurred…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Dec 22, 2022
• Medium 6.5
  CVE-2022-45403

  Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-45404

  Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen withou…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-45405

  Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-45408

  Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seei…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-45410

  When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the S…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-45416

  Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timin…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.5
  CVE-2022-45419

  If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server t…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Dec 22, 2022
• Medium 6.5
  CVE-2022-45420

  Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.1
  CVE-2022-45411

  Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 6.1
  CVE-2022-45413

  Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Dec 22, 2022
• Medium 6.1
  CVE-2022-45418

  If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the bro…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Medium 4.3
  CVE-2022-45417

  Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers be…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Dec 22, 2022

Revision history

1. 2025-05-29 #14

   Neue Updates von Amazon aufgenommen

2. 2023-09-27 #13

   Neue Updates von Amazon aufgenommen

3. 2023-02-05 #12

   Neue Updates von Ubuntu aufgenommen

4. 2022-12-13 #11

   Neue Updates von Red Hat aufgenommen

5. 2022-12-06 #10

   Neue Updates von Amazon aufgenommen

6. 2022-11-30 #9

   Neue Updates von CentOS aufgenommen

7. 2022-11-28 #8

   Neue Updates von SUSE aufgenommen

8. 2022-11-23 #7

   Neue Updates von Oracle Linux aufgenommen

9. 2022-11-22 #6

   Neue Updates von Red Hat aufgenommen

10. 2022-11-21 #5

    Neue Updates von Red Hat, Oracle Linux und Gentoo aufgenommen

11. 2022-11-20 #4

    Neue Updates von SUSE aufgenommen

12. 2022-11-17 #3

    Neue Updates von SUSE und Debian aufgenommen

13. 2022-11-16 #2

    Neue Updates von Fedora, Ubuntu und Debian aufgenommen

14. 2022-11-15 #1

    Initiale Fassung

References

• Mozilla Foundation Security Advisory 2022-47 vom 2022-11-15
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-47/
• Mozilla Foundation Security Advisory 2022-48 vom 2022-11-15
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/
• Mozilla Foundation Security Advisory 2022-49 vom 2022-11-15
  https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/
• Ubuntu Security Notice USN-5726-1 vom 2022-11-16
  https://ubuntu.com/security/notices/USN-5726-1
• Debian Security Advisory DSA-5282 vom 2022-11-17
  https://www.debian.org/security/2022/dsa-5282
• SUSE Security Update SUSE-SU-2022:4058-1 vom 2022-11-17
  https://lists.suse.com/pipermail/sle-security-updates/2022-November/012966.html
• Debian Security Advisory DLA-3199 vom 2022-11-17
  https://lists.debian.org/debian-lts-announce/2022/11/msg00026.html
• Debian Security Advisory DSA-5284 vom 2022-11-17
  https://lists.debian.org/debian-security-announce/2022/msg00255.html
• Debian Security Advisory DLA-3196 vom 2022-11-17
  https://lists.debian.org/debian-lts-announce/2022/11/msg00023.html
• SUSE Security Update SUSE-SU-2022:4085-1 vom 2022-11-18
  https://lists.suse.com/pipermail/sle-security-updates/2022-November/012993.html
• SUSE Security Update SUSE-SU-2022:4083-1 vom 2022-11-18
  https://lists.suse.com/pipermail/sle-security-updates/2022-November/012997.html
• Red Hat Security Advisory RHSA-2022:8556 vom 2022-11-21
  https://access.redhat.com/errata/RHSA-2022:8556
• Oracle Linux Security Advisory ELSA-2022-8552 vom 2022-11-22
  https://linux.oracle.com/errata/ELSA-2022-8552.html
• Red Hat Security Advisory RHSA-2022:8543 vom 2022-11-21
  https://access.redhat.com/errata/RHSA-2022:8543
• Red Hat Security Advisory RHSA-2022:8544 vom 2022-11-21
  https://access.redhat.com/errata/RHSA-2022:8544
• Red Hat Security Advisory RHSA-2022:8545 vom 2022-11-21
  https://access.redhat.com/errata/RHSA-2022:8545
• Red Hat Security Advisory RHSA-2022:8547 vom 2022-11-21
  https://access.redhat.com/errata/RHSA-2022:8547
• Red Hat Security Advisory RHSA-2022:8548 vom 2022-11-21
  https://access.redhat.com/errata/RHSA-2022:8548
• Red Hat Security Advisory RHSA-2022:8549 vom 2022-11-21
  https://access.redhat.com/errata/RHSA-2022:8549
• Red Hat Security Advisory RHSA-2022:8550 vom 2022-11-21
  https://access.redhat.com/errata/RHSA-2022:8550
• Red Hat Security Advisory RHSA-2022:8552 vom 2022-11-21
  https://access.redhat.com/errata/RHSA-2022:8552
• Red Hat Security Advisory RHSA-2022:8553 vom 2022-11-21
  https://access.redhat.com/errata/RHSA-2022:8553
• Red Hat Security Advisory RHSA-2022:8554 vom 2022-11-21
  https://access.redhat.com/errata/RHSA-2022:8554
• Red Hat Security Advisory RHSA-2022:8561 vom 2022-11-21
  https://access.redhat.com/errata/RHSA-2022:8561
• Red Hat Security Advisory RHSA-2022:8555 vom 2022-11-21
  https://access.redhat.com/errata/RHSA-2022:8555
• Gentoo Linux Security Advisory GLSA-202211-06 vom 2022-11-22
  https://security.gentoo.org/glsa/202211-06
• Oracle Linux Security Advisory ELSA-2022-8555 vom 2022-11-22
  https://linux.oracle.com/errata/ELSA-2022-8555.html
• Gentoo Linux Security Advisory GLSA-202211-05 vom 2022-11-22
  https://security.gentoo.org/glsa/202211-05
• Red Hat Security Advisory RHSA-2022:8580 vom 2022-11-22
  https://access.redhat.com/errata/RHSA-2022:8580
• Oracle Linux Security Advisory ELSA-2022-8547 vom 2022-11-22
  https://linux.oracle.com/errata/ELSA-2022-8547.html
• Oracle Linux Security Advisory ELSA-2022-8561 vom 2022-11-24
  http://linux.oracle.com/errata/ELSA-2022-8561.html
• Oracle Linux Security Advisory ELSA-2022-8580 vom 2022-11-24
  http://linux.oracle.com/errata/ELSA-2022-8580.html
• SUSE Security Update SUSE-SU-2022:4247-1 vom 2022-11-28
  https://lists.suse.com/pipermail/sle-security-updates/2022-November/013128.html
• CentOS Security Advisory CESA-2022:8555 vom 2022-12-01
  https://lists.centos.org/pipermail/centos-announce/2022-November/073660.html
• CentOS Security Advisory CESA-2022:8552 vom 2022-12-01
  https://lists.centos.org/pipermail/centos-announce/2022-November/073659.html
• Amazon Linux Security Advisory ALAS-2022-1900 vom 2022-12-07
  https://alas.aws.amazon.com/AL2/ALAS-2022-1900.html
• Red Hat Security Advisory RHSA-2022:8980 vom 2022-12-13
  https://access.redhat.com/errata/RHSA-2022:8980
• Red Hat Security Advisory RHSA-2022:8979 vom 2022-12-13
  https://access.redhat.com/errata/RHSA-2022:8979
• Ubuntu Security Notice USN-5824-1 vom 2023-02-06
  https://ubuntu.com/security/notices/USN-5824-1
• Amazon Linux Security Advisory ALASFIREFOX-2023-010 vom 2023-09-27
  https://alas.aws.amazon.com/AL2/ALASFIREFOX-2023-010.html
• Amazon Linux Security Advisory ALASFIREFOX-2023-009 vom 2023-09-27
  https://alas.aws.amazon.com/AL2/ALASFIREFOX-2023-009.html
• Amazon Linux Security Advisory ALAS-2025-2858 vom 2025-05-29
  https://alas.aws.amazon.com/AL2/ALAS-2025-2858.html