DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Mozilla Firefox, Mozilla Firefox ESR und Thunderbird: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2022-04-05
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Thunderbird ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, falsche Informationen darzustellen und einen Denial-of-Service-Zustand zu verursachen.
01
beschreibt (13)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-28289US | high8.8 | — | ||
Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91.7. Some… | ||||
| CVE-2022-28288US | high8.8 | — | ||
Mozilla developers and community members Randell Jesup, Sebastian Hengst, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 98. Some of these bugs showed… | ||||
| CVE-2022-28287US | medium6.5 | — | ||
In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. This vulnerability affects Firefox < 99. | ||||
| CVE-2022-28286US | medium5.4 | — | ||
Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks. This vulnerability affects Thunde… | ||||
| CVE-2022-28285US | medium6.5 | — | ||
When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conjunction with another vulnerability this could have been used f… | ||||
| CVE-2022-28284US | high8.8 | — | ||
SVG's <code><use></code> element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to al… | ||||
| CVE-2022-28283US | medium6.5 | — | ||
The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should have been inaccessib… | ||||
| CVE-2022-28282US | medium6.5 | — | ||
By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object… | ||||
| CVE-2022-28281US | high8.8 | Exploit | ||
If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to… | ||||
| CVE-2022-1197US | medium5.4 | — | ||
When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the exist… | ||||
| CVE-2022-1196US | medium6.5 | — | ||
After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunde… | ||||
| CVE-2022-1097US | medium6.5 | — | ||
<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exp… | ||||
| CVE-2022-24713US | high7.5 | Exploit | ||
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted rege… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2022:1283 vom 2022-04-08external
- Red Hat Security Advisory RHSA-2022:1284 vom 2022-04-08external
- Red Hat Security Advisory RHSA-2022:1285 vom 2022-04-08external
- Red Hat Security Advisory RHSA-2022:1286 vom 2022-04-08external
- Red Hat Security Advisory RHSA-2022:1287 vom 2022-04-08external
- Red Hat Security Advisory RHSA-2022:1301 vom 2022-04-11external
- Red Hat Security Advisory RHSA-2022:1302 vom 2022-04-11external
- Red Hat Security Advisory RHSA-2022:1303 vom 2022-04-11external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan