Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2022-22749: Security Vulnerabilities fixed in Firefox 96

When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content.<br>This bug only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox < 96.

CVE
#vulnerability#web#android#mac#windows#perl#firefox

Mozilla Foundation Security Advisory 2022-01

Announced

January 11, 2022

Impact

high

Products

Firefox

Fixed in

  • Firefox 96

#CVE-2022-22746: Calling into reportValidity could have lead to fullscreen window spoof

Reporter

Irvan Kurniawan

Impact

high

Description

A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.
This bug only affects Firefox for Windows. Other operating systems are unaffected.

References

  • Bug 1735071

#CVE-2022-22743: Browser window spoof using fullscreen mode

Reporter

Irvan Kurniawan

Impact

high

Description

When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode.

References

  • Bug 1739220

#CVE-2022-22742: Out-of-bounds memory access when inserting text in edit mode

Reporter

Irvan Kurniawan

Impact

high

Description

When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash.

References

  • Bug 1739923

#CVE-2022-22741: Browser window spoof using fullscreen mode

Reporter

Irvan Kurniawan

Impact

high

Description

When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode.

References

  • Bug 1740389

#CVE-2022-22740: Use-after-free of ChannelEventQueue::mOwner

Reporter

bo13oy of Cyber Kunlun Lab

Impact

high

Description

Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash.

References

  • Bug 1742334

#CVE-2022-22738: Heap-buffer-overflow in blendGaussianBlur

Reporter

Atte Kettunen

Impact

high

Description

Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially exploitable crash.

References

  • Bug 1742382

#CVE-2022-22737: Race condition when playing audio files

Reporter

bo13oy of Cyber Kunlun Lab

Impact

high

Description

Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable crash.

References

  • Bug 1745874

#CVE-2021-4140: Iframe sandbox bypass with XSLT

Reporter

Peter Van der Beken

Impact

high

Description

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox.

References

  • Bug 1746720

#CVE-2022-22750: IPC passing of resource handles could have lead to sandbox bypass

Reporter

Jed Davis

Impact

moderate

Description

By generally accepting and passing resource handles across processes, a compromised content process might have confused higher privileged processes to interact with handles that the unprivileged process should not have access to.
This bug only affects Firefox for Windows and MacOS. Other operating systems are unaffected.

References

  • Bug 1566608

#CVE-2022-22749: Lack of URL restrictions when scanning QR codes

Reporter

Wladimir Palant working with Include Security

Impact

moderate

Description

When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content.
This bug only affects Firefox for Android. Other operating systems are unaffected.

References

  • Bug 1705094

#CVE-2022-22748: Spoofed origin on external protocol launch dialog

Reporter

Alesandro Ortiz

Impact

moderate

Description

Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol.

References

  • Bug 1705211

#CVE-2022-22745: Leaking cross-origin URLs through securitypolicyviolation event

Reporter

Jannis Rautenstrauch

Impact

moderate

Description

Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations

References

  • Bug 1735856

#CVE-2022-22744: The ‘Copy as curl’ feature in DevTools did not fully escape website-controlled data, potentially leading to command injection

Reporter

Mattias Jacobsson

Impact

moderate

Description

The constructed curl command from the “Copy as curl” feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if pasted into a Powershell prompt.
This bug only affects Firefox for Windows. Other operating systems are unaffected.

References

  • Bug 1737252

#CVE-2022-22763: Script Execution during invalid object state

Reporter

Mozilla Fuzzing Team

Impact

moderate

Description

When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible.

References

  • Bug 1740534

#CVE-2022-22747: Crash when handling empty pkcs7 sequence

Reporter

Tavis Ormandy

Impact

low

Description

After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable.

References

  • Bug 1735028

#CVE-2022-22736: Potential local privilege escalation when loading modules from the install directory.

Reporter

Toshihito Kikuchi

Impact

low

Description

If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory for system libraries. However the install directory is not world-writable by default.
This bug only affects Firefox for Windows in a non-default installation. Other operating systems are unaffected.

References

  • Bug 1742692

#CVE-2022-22739: Missing throttling on external protocol launch dialog

Reporter

Alesandro Ortiz

Impact

low

Description

Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol.

References

  • Bug 1744158

#CVE-2022-22751: Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5

Reporter

Mozilla developers and community

Impact

high

Description

Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR 91.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

  • Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5

#CVE-2022-22752: Memory safety bugs fixed in Firefox 96

Reporter

Mozilla developers and community

Impact

moderate

Description

Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

  • Memory safety bugs fixed in Firefox 96

Related news

Ubuntu Security Notice USN-5872-1

Ubuntu Security Notice 5872-1 - Tavis Ormandy discovered that NSS incorrectly handled an empty pkcs7 sequence. A remote attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service. Ronald Crane discovered that NSS incorrectly handled certain memory operations. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code.

CVE-2021-4140: Security Vulnerabilities fixed in Firefox ESR 91.5

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2021-4140: Security Vulnerabilities fixed in Firefox ESR 91.5

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2022-22746: Invalid Bug ID

A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.<br>*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2021-4140: Security Vulnerabilities fixed in Firefox ESR 91.5

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2022-22752: Bug List

Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 96.

CVE-2021-4140: Security Vulnerabilities fixed in Firefox ESR 91.5

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2021-4140: Security Vulnerabilities fixed in Firefox ESR 91.5

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2021-4140: Security Vulnerabilities fixed in Firefox ESR 91.5

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2021-4140: Security Vulnerabilities fixed in Firefox ESR 91.5

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2021-4140: Security Vulnerabilities fixed in Firefox ESR 91.5

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2022-22736: Invalid Bug ID

If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory for system libraries. However the install directory is not world-writable by default.<br>*This bug only affects Firefox for Windows in a non-default installation. Other operating systems are unaffected.*. This vulnerability affects Firefox < 96.

CVE-2021-4140: Security Vulnerabilities fixed in Firefox ESR 91.5

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2021-4140: Security Vulnerabilities fixed in Firefox ESR 91.5

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2021-4140: Security Vulnerabilities fixed in Firefox ESR 91.5

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2022-22759: Security Vulnerabilities fixed in Thunderbird 91.6

If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.

CVE-2022-22748: Invalid Bug ID

Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2021-4140: Security Vulnerabilities fixed in Firefox ESR 91.5

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2022-22743: Invalid Bug ID

When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2022-22745: Invalid Bug ID

Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2021-4140: Security Vulnerabilities fixed in Firefox ESR 91.5

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

CVE-2021-4140: Security Vulnerabilities fixed in Firefox ESR 91.5

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

Gentoo Linux Security Advisory 202208-14

Gentoo Linux Security Advisory 202208-14 - Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. Versions less than 91.12.0 are affected.

Gentoo Linux Security Advisory 202208-14

Gentoo Linux Security Advisory 202208-14 - Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. Versions less than 91.12.0 are affected.

Gentoo Linux Security Advisory 202208-14

Gentoo Linux Security Advisory 202208-14 - Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. Versions less than 91.12.0 are affected.

Gentoo Linux Security Advisory 202208-14

Gentoo Linux Security Advisory 202208-14 - Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. Versions less than 91.12.0 are affected.

Gentoo Linux Security Advisory 202208-14

Gentoo Linux Security Advisory 202208-14 - Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. Versions less than 91.12.0 are affected.

Gentoo Linux Security Advisory 202208-14

Gentoo Linux Security Advisory 202208-14 - Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. Versions less than 91.12.0 are affected.

Gentoo Linux Security Advisory 202208-14

Gentoo Linux Security Advisory 202208-14 - Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. Versions less than 91.12.0 are affected.

Gentoo Linux Security Advisory 202208-14

Gentoo Linux Security Advisory 202208-14 - Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. Versions less than 91.12.0 are affected.

Gentoo Linux Security Advisory 202208-14

Gentoo Linux Security Advisory 202208-14 - Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. Versions less than 91.12.0 are affected.

Gentoo Linux Security Advisory 202208-14

Gentoo Linux Security Advisory 202208-14 - Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. Versions less than 91.12.0 are affected.

Gentoo Linux Security Advisory 202208-14

Gentoo Linux Security Advisory 202208-14 - Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. Versions less than 91.12.0 are affected.

Gentoo Linux Security Advisory 202208-14

Gentoo Linux Security Advisory 202208-14 - Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. Versions less than 91.12.0 are affected.

Gentoo Linux Security Advisory 202208-14

Gentoo Linux Security Advisory 202208-14 - Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. Versions less than 91.12.0 are affected.

Ubuntu Security Notice USN-5506-1

Ubuntu Security Notice 5506-1 - Tavis Ormandy discovered that NSS incorrectly handled an empty pkcs7 sequence. A remote attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. Ronald Crane discovered that NSS incorrectly handled certain memory operations. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907