DeutschShown in its original language — a full translation is planned for a future version.
Xerox FreeFlow Print Server: Mehrere Schwachstellen
view advisory published 2022-02-03
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder Dateien zu manipulieren.
01
describes (119)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-22752US | high8.8 | — | ||
Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that… | ||||
| CVE-2022-22751US | high8.8 | — | ||
Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present… | ||||
| CVE-2022-22750US | medium6.5 | — | ||
By generally accepting and passing resource handles across processes, a compromised content process might have confused higher privileged processes to interact with handles that th… | ||||
| CVE-2022-22749US | medium4.3 | — | ||
When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content.<br>*This bug only affects Firefox for Android. Other operat… | ||||
| CVE-2022-22748US | medium6.5 | — | ||
Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol. This vulnerability affects Firef… | ||||
| CVE-2022-22747US | medium6.5 | — | ||
After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. T… | ||||
| CVE-2022-22746US | medium5.9 | — | ||
A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.<br>*This bug only affects Firefox for… | ||||
| CVE-2022-22745US | medium6.5 | — | ||
Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbi… | ||||
| CVE-2022-22744US | high8.8 | — | ||
The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if pasted into a Powersh… | ||||
| CVE-2022-22743US | medium4.3 | — | ||
When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode. This vulnerability… | ||||
| CVE-2022-22742US | medium6.5 | — | ||
When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash. This vulnerability affects Firefox E… | ||||
| CVE-2022-22741US | high7.5 | — | ||
When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96,… | ||||
| CVE-2022-22740US | high8.8 | — | ||
Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash. This… | ||||
| CVE-2022-22739US | medium6.5 | — | ||
Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and… | ||||
| CVE-2022-22738US | high8.8 | — | ||
Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially exploitable crash. This vulnerability af… | ||||
| CVE-2022-22737US | high7.5 | — | ||
Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitabl… | ||||
| CVE-2022-22736US | high7.0 | — | ||
If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory for system libraries. However the insta… | ||||
| CVE-2021-4140US | critical10.0 | — | ||
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.… | ||||
| CVE-2021-4129US | critical9.8 | — | ||
Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in Fi… | ||||
| CVE-2021-4128US | medium6.5 | — | ||
When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory corruption and a potentially exploitable crash.<br>*This bug on… | ||||
showing 20 of 119
02
references
External citations — patches, advisories, analysis.
- Xerox Security Bulletinexternal
- Xerox Security Bulletinexternal
- Xerox Security Bulletinexternal
- XEROX Security Advisory XRX23-005 vom 2023-04-04external
- XEROX Security Advisory XRX25-017 vom 2025-10-07external
- Xerox Security Bulletin: XR22-001 vom 2022-02-03external
- XEROX Security Advisory XRX22-004 vom 2022-02-14external
- XEROX Security Advisory XRX22-005 vom 2022-02-14external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan