DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Xerox FreeFlow Print Server: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2022-09-07
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
01
beschreibt (163)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-31747US | critical9.8 | — | ||
Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9. Some of these bugs sh… | ||||
| CVE-2022-31742US | medium6.5 | — | ||
An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key… | ||||
| CVE-2022-31741US | high8.8 | — | ||
A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability affects Thunderbird <… | ||||
| CVE-2022-31740US | high8.8 | — | ||
On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash. This vulnerability affects T… | ||||
| CVE-2022-31739US | high8.8 | — | ||
When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables suc… | ||||
| CVE-2022-31738US | medium6.5 | — | ||
When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulne… | ||||
| CVE-2022-31737US | critical9.8 | — | ||
A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91… | ||||
| CVE-2022-31736US | critical9.8 | — | ||
A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox… | ||||
| CVE-2022-29917US | critical9.8 | — | ||
Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR 91.8. Some of these… | ||||
| CVE-2022-29916US | medium6.5 | — | ||
Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the browser history. This vu… | ||||
| CVE-2022-29914US | medium6.5 | — | ||
When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. This vulnerability affects… | ||||
| CVE-2022-29913US | medium6.5 | — | ||
The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions from a child process. This vulnerability affects Thunderbir… | ||||
| CVE-2022-29912US | medium6.1 | — | ||
Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100… | ||||
| CVE-2022-29911US | medium6.1 | — | ||
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code>… | ||||
| CVE-2022-29909US | high8.8OT erhöht | — | ||
Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting t… | ||||
| CVE-2022-28289US | high8.8 | — | ||
Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91.7. Some… | ||||
| CVE-2022-28286US | medium5.4 | — | ||
Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks. This vulnerability affects Thunde… | ||||
| CVE-2022-28285US | medium6.5 | — | ||
When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conjunction with another vulnerability this could have been used f… | ||||
| CVE-2022-28282US | medium6.5 | — | ||
By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object… | ||||
| CVE-2022-28281US | high8.8 | Exploit | ||
If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to… | ||||
20 von 163 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- XEROX Security Advisory XRX23-005 vom 2023-04-04external
- XEROX Security Advisory XRX23-007 vom 2023-05-18external
- XEROX Security Advisory XRX25-017 vom 2025-10-07external
- Xerox Security Bulletin XRX22-021 vom 2022-09-07external
- WID-SEC-W-2022-1335 - CSAF Versionself
- WID-SEC-2022-1335 - Portal Versionself
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan