DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Mozilla Firefox und Thunderbird: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2022-03-08
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Thunderbird und Mozilla Firefox ESR ausnutzen, um mehrere Spoofing-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen und vertrauliche Informationen offenzulegen.
01
beschreibt (8)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-26387US | high7.5 | — | ||
When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modifi… | ||||
| CVE-2022-26386US | medium6.5 | — | ||
Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior was changed to download them to <code>/tm… | ||||
| CVE-2022-26385US | medium6.5 | — | ||
In unusual circumstances, an individual thread may outlive the thread's manager during shutdown. This could have led to a use-after-free causing a potentially exploitable crash. Th… | ||||
| CVE-2022-26384US | critical9.6 | — | ||
If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when clicke… | ||||
| CVE-2022-26383US | medium4.3 | — | ||
When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and… | ||||
| CVE-2022-26382US | medium4.3 | — | ||
While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts. Side-channel attacks on the text by using specially cra… | ||||
| CVE-2022-26381US | high8.8 | — | ||
An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash. This vulnerability affects Firefox < 98, Firefo… | ||||
| CVE-2022-0843US | high8.8 | — | ||
Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 97. Some of these bugs showed evidence of memory corruption an… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Oracle Linux Security Advisory ELSA-2022-0818 vom 2022-03-11external
- Oracle Linux Security Advisory ELSA-2022-0824 vom 2022-03-11external
- Oracle Linux Security Advisory ELSA-2022-0845 vom 2022-03-14external
- Oracle Linux Security Advisory ELSA-2022-0850 vom 2022-03-14external
- Red Hat Security Advisory RHSA-2022:0815 vom 2022-03-10external
- Red Hat Security Advisory RHSA-2022:0816 vom 2022-03-10external
- Red Hat Security Advisory RHSA-2022:0817 vom 2022-03-10external
- Red Hat Security Advisory RHSA-2022:0818 vom 2022-03-10external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan