rhsa-2022_8554
Vulnerability from csaf_redhat
Published
2022-11-21 12:51
Modified
2024-11-22 21:03
Summary
Red Hat Security Advisory: firefox security update
Notes
Topic
An update for firefox is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 102.5.0 ESR.
Security Fix(es):
* Mozilla: Service Workers might have learned size of cross-origin media files (CVE-2022-45403)
* Mozilla: Fullscreen notification bypass (CVE-2022-45404)
* Mozilla: Use-after-free in InputStream implementation (CVE-2022-45405)
* Mozilla: Use-after-free of a JavaScript Realm (CVE-2022-45406)
* Mozilla: Fullscreen notification bypass via windowName (CVE-2022-45408)
* Mozilla: Use-after-free in Garbage Collection (CVE-2022-45409)
* Mozilla: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5 (CVE-2022-45421)
* Mozilla: ServiceWorker-intercepted requests bypassed SameSite cookie policy (CVE-2022-45410)
* Mozilla: Cross-Site Tracing was possible via non-standard override headers (CVE-2022-45411)
* Mozilla: Symlinks may resolve to partially uninitialized buffers (CVE-2022-45412)
* Mozilla: Keystroke Side-Channel Leakage (CVE-2022-45416)
* Mozilla: Custom mouse cursor could have been drawn over browser UI (CVE-2022-45418)
* Mozilla: Iframe contents could be rendered outside the iframe (CVE-2022-45420)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for firefox is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 102.5.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Service Workers might have learned size of cross-origin media files (CVE-2022-45403)\n\n* Mozilla: Fullscreen notification bypass (CVE-2022-45404)\n\n* Mozilla: Use-after-free in InputStream implementation (CVE-2022-45405)\n\n* Mozilla: Use-after-free of a JavaScript Realm (CVE-2022-45406)\n\n* Mozilla: Fullscreen notification bypass via windowName (CVE-2022-45408)\n\n* Mozilla: Use-after-free in Garbage Collection (CVE-2022-45409)\n\n* Mozilla: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5 (CVE-2022-45421)\n\n* Mozilla: ServiceWorker-intercepted requests bypassed SameSite cookie policy (CVE-2022-45410)\n\n* Mozilla: Cross-Site Tracing was possible via non-standard override headers (CVE-2022-45411)\n\n* Mozilla: Symlinks may resolve to partially uninitialized buffers (CVE-2022-45412)\n\n* Mozilla: Keystroke Side-Channel Leakage (CVE-2022-45416)\n\n* Mozilla: Custom mouse cursor could have been drawn over browser UI (CVE-2022-45418)\n\n* Mozilla: Iframe contents could be rendered outside the iframe (CVE-2022-45420)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2022:8554",
"url": "https://access.redhat.com/errata/RHSA-2022:8554"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2143197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143197"
},
{
"category": "external",
"summary": "2143198",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143198"
},
{
"category": "external",
"summary": "2143199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143199"
},
{
"category": "external",
"summary": "2143200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143200"
},
{
"category": "external",
"summary": "2143201",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143201"
},
{
"category": "external",
"summary": "2143202",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143202"
},
{
"category": "external",
"summary": "2143203",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143203"
},
{
"category": "external",
"summary": "2143204",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143204"
},
{
"category": "external",
"summary": "2143205",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143205"
},
{
"category": "external",
"summary": "2143240",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143240"
},
{
"category": "external",
"summary": "2143241",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143241"
},
{
"category": "external",
"summary": "2143242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143242"
},
{
"category": "external",
"summary": "2143243",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143243"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8554.json"
}
],
"title": "Red Hat Security Advisory: firefox security update",
"tracking": {
"current_release_date": "2024-11-22T21:03:15+00:00",
"generator": {
"date": "2024-11-22T21:03:15+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2022:8554",
"initial_release_date": "2022-11-21T12:51:20+00:00",
"revision_history": [
{
"date": "2022-11-21T12:51:20+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2022-11-21T12:51:20+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T21:03:15+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.7.0.Z.MAIN",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:102.5.0-1.el8_7.src",
"product": {
"name": "firefox-0:102.5.0-1.el8_7.src",
"product_id": "firefox-0:102.5.0-1.el8_7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@102.5.0-1.el8_7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:102.5.0-1.el8_7.aarch64",
"product": {
"name": "firefox-0:102.5.0-1.el8_7.aarch64",
"product_id": "firefox-0:102.5.0-1.el8_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@102.5.0-1.el8_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"product": {
"name": "firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"product_id": "firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@102.5.0-1.el8_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"product": {
"name": "firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"product_id": "firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@102.5.0-1.el8_7?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:102.5.0-1.el8_7.ppc64le",
"product": {
"name": "firefox-0:102.5.0-1.el8_7.ppc64le",
"product_id": "firefox-0:102.5.0-1.el8_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@102.5.0-1.el8_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"product": {
"name": "firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"product_id": "firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@102.5.0-1.el8_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"product": {
"name": "firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"product_id": "firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@102.5.0-1.el8_7?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:102.5.0-1.el8_7.x86_64",
"product": {
"name": "firefox-0:102.5.0-1.el8_7.x86_64",
"product_id": "firefox-0:102.5.0-1.el8_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@102.5.0-1.el8_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:102.5.0-1.el8_7.x86_64",
"product": {
"name": "firefox-debugsource-0:102.5.0-1.el8_7.x86_64",
"product_id": "firefox-debugsource-0:102.5.0-1.el8_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@102.5.0-1.el8_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"product": {
"name": "firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"product_id": "firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@102.5.0-1.el8_7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:102.5.0-1.el8_7.s390x",
"product": {
"name": "firefox-0:102.5.0-1.el8_7.s390x",
"product_id": "firefox-0:102.5.0-1.el8_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@102.5.0-1.el8_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"product": {
"name": "firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"product_id": "firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@102.5.0-1.el8_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"product": {
"name": "firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"product_id": "firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@102.5.0-1.el8_7?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:102.5.0-1.el8_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64"
},
"product_reference": "firefox-0:102.5.0-1.el8_7.aarch64",
"relates_to_product_reference": "AppStream-8.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:102.5.0-1.el8_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le"
},
"product_reference": "firefox-0:102.5.0-1.el8_7.ppc64le",
"relates_to_product_reference": "AppStream-8.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:102.5.0-1.el8_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x"
},
"product_reference": "firefox-0:102.5.0-1.el8_7.s390x",
"relates_to_product_reference": "AppStream-8.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:102.5.0-1.el8_7.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src"
},
"product_reference": "firefox-0:102.5.0-1.el8_7.src",
"relates_to_product_reference": "AppStream-8.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:102.5.0-1.el8_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64"
},
"product_reference": "firefox-0:102.5.0-1.el8_7.x86_64",
"relates_to_product_reference": "AppStream-8.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:102.5.0-1.el8_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64"
},
"product_reference": "firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"relates_to_product_reference": "AppStream-8.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le"
},
"product_reference": "firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"relates_to_product_reference": "AppStream-8.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:102.5.0-1.el8_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x"
},
"product_reference": "firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"relates_to_product_reference": "AppStream-8.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:102.5.0-1.el8_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64"
},
"product_reference": "firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"relates_to_product_reference": "AppStream-8.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:102.5.0-1.el8_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64"
},
"product_reference": "firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"relates_to_product_reference": "AppStream-8.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:102.5.0-1.el8_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le"
},
"product_reference": "firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"relates_to_product_reference": "AppStream-8.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:102.5.0-1.el8_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x"
},
"product_reference": "firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"relates_to_product_reference": "AppStream-8.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:102.5.0-1.el8_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
},
"product_reference": "firefox-debugsource-0:102.5.0-1.el8_7.x86_64",
"relates_to_product_reference": "AppStream-8.7.0.Z.MAIN"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-43680",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2022-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2140059"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free flaw was found in the Expat package, caused by destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. This may lead to availability disruptions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability can only happen under special (out-of-memory) conditions, thus it is not possible to exploit on every possible system that has expat installed. Additionally as the flaw is only capable of causing a Denial of Service, Red Hat rates the impact as Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-43680"
},
{
"category": "external",
"summary": "RHBZ#2140059",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140059"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-43680",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43680"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43680",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43680"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/issues/649",
"url": "https://github.com/libexpat/libexpat/issues/649"
}
],
"release_date": "2022-10-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-11-21T12:51:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
"product_ids": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8554"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
},
{
"names": [
"Anne van Kesteren and Karl Tomlinson"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2022-45403",
"cwe": {
"id": "CWE-829",
"name": "Inclusion of Functionality from Untrusted Control Sphere"
},
"discovery_date": "2022-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2143197"
}
],
"notes": [
{
"category": "description",
"text": "The Mozilla Foundation Security Advisory describes this flaw as: Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to determine the presence or length of a media file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Mozilla: Service Workers might have learned size of cross-origin media files",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45403"
},
{
"category": "external",
"summary": "RHBZ#2143197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143197"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45403",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45403"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45403",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45403"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45403",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45403"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45403",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45403"
}
],
"release_date": "2022-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-11-21T12:51:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
"product_ids": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8554"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Mozilla: Service Workers might have learned size of cross-origin media files"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
},
{
"names": [
"Irvan Kurniawan"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2022-45404",
"cwe": {
"id": "CWE-1021",
"name": "Improper Restriction of Rendered UI Layers or Frames"
},
"discovery_date": "2022-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2143198"
}
],
"notes": [
{
"category": "description",
"text": "The Mozilla Foundation Security Advisory describes this flaw as: Through a series of popup and window.print() calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Mozilla: Fullscreen notification bypass",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45404"
},
{
"category": "external",
"summary": "RHBZ#2143198",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143198"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45404",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45404"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45404",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45404"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45404",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45404"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45404",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45404"
}
],
"release_date": "2022-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-11-21T12:51:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
"product_ids": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8554"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Mozilla: Fullscreen notification bypass"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
},
{
"names": [
"Atte Kettunen"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2022-45405",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2022-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2143199"
}
],
"notes": [
{
"category": "description",
"text": "The Mozilla Foundation Security Advisory describes this flaw as: Freeing arbitrary nsIInputStream\u0027s on a different thread than creation could have led to a use-after-free and potentially exploitable crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Mozilla: Use-after-free in InputStream implementation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45405"
},
{
"category": "external",
"summary": "RHBZ#2143199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45405",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45405"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45405",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45405"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45405",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45405"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45405",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45405"
}
],
"release_date": "2022-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-11-21T12:51:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
"product_ids": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8554"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Mozilla: Use-after-free in InputStream implementation"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
},
{
"names": [
"Samuel Gro\u00df"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2022-45406",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2022-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2143200"
}
],
"notes": [
{
"category": "description",
"text": "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nIf an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing a potentially exploitable crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Mozilla: Use-after-free of a JavaScript Realm",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45406"
},
{
"category": "external",
"summary": "RHBZ#2143200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45406",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45406"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45406",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45406"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45406",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45406"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45406",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45406"
}
],
"release_date": "2022-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-11-21T12:51:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
"product_ids": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8554"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Mozilla: Use-after-free of a JavaScript Realm"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
},
{
"names": [
"Irvan Kurniawan"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2022-45408",
"cwe": {
"id": "CWE-1021",
"name": "Improper Restriction of Rendered UI Layers or Frames"
},
"discovery_date": "2022-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2143201"
}
],
"notes": [
{
"category": "description",
"text": "The Mozilla Foundation Security Advisory describes this flaw as: Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Mozilla: Fullscreen notification bypass via windowName",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45408"
},
{
"category": "external",
"summary": "RHBZ#2143201",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143201"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45408",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45408"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45408",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45408"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45408",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45408"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45408",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45408"
}
],
"release_date": "2022-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-11-21T12:51:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
"product_ids": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8554"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Mozilla: Fullscreen notification bypass via windowName"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
},
{
"names": [
"Gary Kwong"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2022-45409",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2022-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2143202"
}
],
"notes": [
{
"category": "description",
"text": "The Mozilla Foundation Security Advisory describes this flaw as: The garbage collector could have been aborted in several states and zones and GCRuntime::finishCollection may not have been called, leading to a use-after-free and potentially exploitable crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Mozilla: Use-after-free in Garbage Collection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45409"
},
{
"category": "external",
"summary": "RHBZ#2143202",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143202"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45409",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45409"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45409",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45409"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45409",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45409"
}
],
"release_date": "2022-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-11-21T12:51:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
"product_ids": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8554"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Mozilla: Use-after-free in Garbage Collection"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
},
{
"names": [
"Dongsung Kim"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2022-45410",
"cwe": {
"id": "CWE-1275",
"name": "Sensitive Cookie with Improper SameSite Attribute"
},
"discovery_date": "2022-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2143203"
}
],
"notes": [
{
"category": "description",
"text": "The Mozilla Foundation Security Advisory describes this flaw as: When a ServiceWorker intercepted a request with FetchEvent, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Mozilla: ServiceWorker-intercepted requests bypassed SameSite cookie policy",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45410"
},
{
"category": "external",
"summary": "RHBZ#2143203",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143203"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45410",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45410"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45410",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45410"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45410",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45410"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45410",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45410"
}
],
"release_date": "2022-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-11-21T12:51:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
"product_ids": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8554"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Mozilla: ServiceWorker-intercepted requests bypassed SameSite cookie policy"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
},
{
"names": [
"scarlet"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2022-45411",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2022-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2143204"
}
],
"notes": [
{
"category": "description",
"text": "The Mozilla Foundation Security Advisory describes this flaw as: Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). To mitigate this attack, browsers placed limits on fetch() and XMLHttpRequest; however some webservers have implemented non-standard headers such as X-Http-Method-Override that override the HTTP method, and made this attack possible again. Firefox has applied the same mitigations to the use of this and similar headers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Mozilla: Cross-Site Tracing was possible via non-standard override headers",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45411"
},
{
"category": "external",
"summary": "RHBZ#2143204",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143204"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45411",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45411"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45411",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45411"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45411",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45411"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45411",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45411"
}
],
"release_date": "2022-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-11-21T12:51:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
"product_ids": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8554"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Mozilla: Cross-Site Tracing was possible via non-standard override headers"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
},
{
"names": [
"Armin Ebert"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2022-45412",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2022-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2143205"
}
],
"notes": [
{
"category": "description",
"text": "The Mozilla Foundation Security Advisory describes this flaw as:\r\n\r\nWhen resolving a symlink such as file:///proc/self/fd/1, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Mozilla: Symlinks may resolve to partially uninitialized buffers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45412"
},
{
"category": "external",
"summary": "RHBZ#2143205",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143205"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45412",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45412"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45412",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45412"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45412",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45412"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45412",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45412"
}
],
"release_date": "2022-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-11-21T12:51:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
"product_ids": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8554"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Mozilla: Symlinks may resolve to partially uninitialized buffers"
},
{
"acknowledgments": [
{
"names": [
"Erik Kraft",
"Martin Schwarzl",
"the Mozilla project"
]
},
{
"names": [
"Andrew McCreight"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2022-45416",
"discovery_date": "2022-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2143240"
}
],
"notes": [
{
"category": "description",
"text": "The Mozilla Foundation Security Advisory describes this flaw as: Keyboard events reference strings like \"KeyA\" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have possibly figured out which keys were being pressed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Mozilla: Keystroke Side-Channel Leakage",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45416"
},
{
"category": "external",
"summary": "RHBZ#2143240",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143240"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45416",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45416"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45416",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45416"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45416",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45416"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45416",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45416"
}
],
"release_date": "2022-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-11-21T12:51:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
"product_ids": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8554"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Mozilla: Keystroke Side-Channel Leakage"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
},
{
"names": [
"Hafiizh"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2022-45418",
"discovery_date": "2022-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2143241"
}
],
"notes": [
{
"category": "description",
"text": "The Mozilla Foundation Security Advisory describes this flaw as: If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Mozilla: Custom mouse cursor could have been drawn over browser UI",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45418"
},
{
"category": "external",
"summary": "RHBZ#2143241",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143241"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45418",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45418"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45418",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45418"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45418",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45418"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45418",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45418"
}
],
"release_date": "2022-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-11-21T12:51:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
"product_ids": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8554"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Mozilla: Custom mouse cursor could have been drawn over browser UI"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
},
{
"names": [
"Suhwan Song of SNU CompSec Lab"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2022-45420",
"discovery_date": "2022-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2143242"
}
],
"notes": [
{
"category": "description",
"text": "The Mozilla Foundation Security Advisory describes this flaw as: Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Mozilla: Iframe contents could be rendered outside the iframe",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45420"
},
{
"category": "external",
"summary": "RHBZ#2143242",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143242"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45420",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45420"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45420",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45420"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45420",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45420"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45420",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45420"
}
],
"release_date": "2022-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-11-21T12:51:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
"product_ids": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8554"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Mozilla: Iframe contents could be rendered outside the iframe"
},
{
"acknowledgments": [
{
"names": [
"the Mozilla project"
]
},
{
"names": [
"Mozilla developers"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2022-45421",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2022-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2143243"
}
],
"notes": [
{
"category": "description",
"text": "The Mozilla Foundation Security Advisory describes this flaw as: Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Firefox 106 and Firefox ESR 102.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Mozilla: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45421"
},
{
"category": "external",
"summary": "RHBZ#2143243",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143243"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45421",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45421"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45421",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45421"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45421",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45421"
},
{
"category": "external",
"summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45421",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45421"
}
],
"release_date": "2022-11-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2022-11-21T12:51:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
"product_ids": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2022:8554"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.src",
"AppStream-8.7.0.Z.MAIN:firefox-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debuginfo-0:102.5.0-1.el8_7.x86_64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.aarch64",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.ppc64le",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.s390x",
"AppStream-8.7.0.Z.MAIN:firefox-debugsource-0:102.5.0-1.el8_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Mozilla: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.