csaf_certbund - wid-sec-w-2022-0482

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Firefox ist ein Open Source Web Browser.\r\nESR ist die Variante mit verl\u00e4ngertem Support.\r\nThunderbird ist ein Open Source E-Mail Client.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Thunderbird ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, falsche Informationen darzustellen und einen Denial-of-Service-Zustand zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-0482 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0482.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-0482 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0482"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:3526-1 vom 2023-09-05",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-September/016091.html"
      },
      {
        "category": "external",
        "summary": "Mozilla Security Advisory vom 2022-04-05",
        "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-13/"
      },
      {
        "category": "external",
        "summary": "Mozilla Security Advisory vom 2022-04-05",
        "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-14/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Advisory vom 2022-04-05",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-April/010659.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Advisory vom 2022-04-05",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-April/010660.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Bug-Tracker 2072559 vom 2022-04-06",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072559"
      },
      {
        "category": "external",
        "summary": "Mozilla Security Advisory MFSA2022-15 vom 2022-04-06",
        "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2022-15/"
      },
      {
        "category": "external",
        "summary": "Red Hat Bug-Tracker 2072560 vom 2022-04-06",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072560"
      },
      {
        "category": "external",
        "summary": "Red Hat Bug-Tracker 2072562 vom 2022-04-06",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072562"
      },
      {
        "category": "external",
        "summary": "Red Hat Bug-Tracker 2072566 vom 2022-04-06",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072566"
      },
      {
        "category": "external",
        "summary": "Red Hat Bug-Tracker 2072561 vom 2022-04-06",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072561"
      },
      {
        "category": "external",
        "summary": "Red Hat Bug-Tracker 2072565 vom 2022-04-06",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072565"
      },
      {
        "category": "external",
        "summary": "Red Hat Bug-Tracker 2072564 vom 2022-04-06",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072564"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-5113 vom 2022-04-06",
        "url": "https://lists.debian.org/debian-security-announce/2022/msg00081.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Bug-Tracker 2072563 vom 2022-04-06",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072563"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-5370-1 vom 2022-04-07",
        "url": "https://ubuntu.com/security/notices/USN-5370-1"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-2971 vom 2022-04-07",
        "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00003.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:1127-1 vom 2022-04-07",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-April/010667.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1285 vom 2022-04-08",
        "url": "https://access.redhat.com/errata/RHSA-2022:1285"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1286 vom 2022-04-08",
        "url": "https://access.redhat.com/errata/RHSA-2022:1286"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1287 vom 2022-04-08",
        "url": "https://access.redhat.com/errata/RHSA-2022:1287"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-5118 vom 2022-04-10",
        "url": "https://lists.debian.org/debian-security-announce/2022/msg00086.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2022-1284 vom 2022-04-08",
        "url": "https://linux.oracle.com/errata/ELSA-2022-1284.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2022-1287 vom 2022-04-08",
        "url": "https://linux.oracle.com/errata/ELSA-2022-1287.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1283 vom 2022-04-08",
        "url": "https://access.redhat.com/errata/RHSA-2022:1283"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1284 vom 2022-04-08",
        "url": "https://access.redhat.com/errata/RHSA-2022:1284"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1301 vom 2022-04-11",
        "url": "https://access.redhat.com/errata/RHSA-2022:1301"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1302 vom 2022-04-11",
        "url": "https://access.redhat.com/errata/RHSA-2022:1302"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:1149-1 vom 2022-04-11",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-April/010677.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1303 vom 2022-04-11",
        "url": "https://access.redhat.com/errata/RHSA-2022:1303"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1305 vom 2022-04-11",
        "url": "https://access.redhat.com/errata/RHSA-2022:1305"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-2978 vom 2022-04-11",
        "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00009.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2022-1302 vom 2022-04-12",
        "url": "https://linux.oracle.com/errata/ELSA-2022-1302.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2022-1301 vom 2022-04-12",
        "url": "https://linux.oracle.com/errata/ELSA-2022-1301.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1326 vom 2022-04-12",
        "url": "https://access.redhat.com/errata/RHSA-2022:1326"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:1176-1 vom 2022-04-13",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-April/010699.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2022-1789 vom 2022-04-27",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2022-1789.html"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-5393-1 vom 2022-04-27",
        "url": "https://ubuntu.com/security/notices/USN-5393-1"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-5494-1 vom 2022-06-27",
        "url": "https://ubuntu.com/security/notices/USN-5494-1"
      },
      {
        "category": "external",
        "summary": "Gentoo Linux Security Advisory GLSA-202208-14 vom 2022-08-14",
        "url": "https://security.gentoo.org/glsa/202208-14"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-5610-1 vom 2022-09-14",
        "url": "https://ubuntu.com/security/notices/USN-5610-1"
      },
      {
        "category": "external",
        "summary": "Gentoo Linux Security Advisory GLSA-202212-05 vom 2022-12-19",
        "url": "https://security.gentoo.org/glsa/202212-05"
      },
      {
        "category": "external",
        "summary": "Mozilla Bugzilla vom 2023-01-01",
        "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1751609"
      }
    ],
    "source_lang": "en-US",
    "title": "Mozilla Firefox, Mozilla Firefox ESR und Thunderbird: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-09-05T22:00:00.000+00:00",
      "generator": {
        "date": "2024-02-15T16:50:14.193+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2022-0482",
      "initial_release_date": "2022-04-05T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-04-05T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2022-04-06T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat, Mozilla und Debian aufgenommen"
        },
        {
          "date": "2022-04-07T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Ubuntu, Debian und SUSE aufgenommen"
        },
        {
          "date": "2022-04-10T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Red Hat, Debian und Oracle Linux aufgenommen"
        },
        {
          "date": "2022-04-11T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat, SUSE und Debian aufgenommen"
        },
        {
          "date": "2022-04-12T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-04-13T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2022-04-27T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Amazon und Ubuntu aufgenommen"
        },
        {
          "date": "2022-06-27T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2022-08-14T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Gentoo aufgenommen"
        },
        {
          "date": "2022-09-13T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2022-12-18T23:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Gentoo aufgenommen"
        },
        {
          "date": "2023-01-01T23:00:00.000+00:00",
          "number": "13",
          "summary": "PoC aufgenommen"
        },
        {
          "date": "2023-09-05T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von SUSE aufgenommen"
        }
      ],
      "status": "final",
      "version": "14"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Gentoo Linux",
            "product": {
              "name": "Gentoo Linux",
              "product_id": "T012167",
              "product_identification_helper": {
                "cpe": "cpe:/o:gentoo:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Gentoo"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Mozilla Firefox \u003c 99",
            "product": {
              "name": "Mozilla Firefox \u003c 99",
              "product_id": "T022536",
              "product_identification_helper": {
                "cpe": "cpe:/a:mozilla:firefox:99"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Mozilla Firefox ESR \u003c 91.8",
            "product": {
              "name": "Mozilla Firefox ESR \u003c 91.8",
              "product_id": "T022537",
              "product_identification_helper": {
                "cpe": "cpe:/a:mozilla:firefox_esr:91.8"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Mozilla Thunderbird \u003c 91.8",
            "product": {
              "name": "Mozilla Thunderbird \u003c 91.8",
              "product_id": "T022574",
              "product_identification_helper": {
                "cpe": "cpe:/a:mozilla:thunderbird:91.8"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Mozilla"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-1097",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Thunderbird. Die Fehler bestehen aufgrund von mehreren Use-after-free-Fehlern, einem Out-of-bounds-Write, einer fehlenden Sicherheits\u00fcberpr\u00fcfung, einem Out-of-bounds-Read, einem Spoofing-Angriff, einem Fehler in der Ressourcenverwaltung, mehreren Puffer\u00fcberl\u00e4ufen und einer Ressourcenersch\u00f6pfung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, falsche Informationen darzustellen und einen Denial-of-Service-Zustand zu verursachen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646",
          "T000126",
          "398363",
          "T012167",
          "T004914"
        ]
      },
      "release_date": "2022-04-05T22:00:00Z",
      "title": "CVE-2022-1097"
    },
    {
      "cve": "CVE-2022-1196",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Thunderbird. Die Fehler bestehen aufgrund von mehreren Use-after-free-Fehlern, einem Out-of-bounds-Write, einer fehlenden Sicherheits\u00fcberpr\u00fcfung, einem Out-of-bounds-Read, einem Spoofing-Angriff, einem Fehler in der Ressourcenverwaltung, mehreren Puffer\u00fcberl\u00e4ufen und einer Ressourcenersch\u00f6pfung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, falsche Informationen darzustellen und einen Denial-of-Service-Zustand zu verursachen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646",
          "T000126",
          "398363",
          "T012167",
          "T004914"
        ]
      },
      "release_date": "2022-04-05T22:00:00Z",
      "title": "CVE-2022-1196"
    },
    {
      "cve": "CVE-2022-1197",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Thunderbird. Die Fehler bestehen aufgrund von mehreren Use-after-free-Fehlern, einem Out-of-bounds-Write, einer fehlenden Sicherheits\u00fcberpr\u00fcfung, einem Out-of-bounds-Read, einem Spoofing-Angriff, einem Fehler in der Ressourcenverwaltung, mehreren Puffer\u00fcberl\u00e4ufen und einer Ressourcenersch\u00f6pfung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, falsche Informationen darzustellen und einen Denial-of-Service-Zustand zu verursachen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646",
          "T000126",
          "398363",
          "T012167",
          "T004914"
        ]
      },
      "release_date": "2022-04-05T22:00:00Z",
      "title": "CVE-2022-1197"
    },
    {
      "cve": "CVE-2022-24713",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Thunderbird. Die Fehler bestehen aufgrund von mehreren Use-after-free-Fehlern, einem Out-of-bounds-Write, einer fehlenden Sicherheits\u00fcberpr\u00fcfung, einem Out-of-bounds-Read, einem Spoofing-Angriff, einem Fehler in der Ressourcenverwaltung, mehreren Puffer\u00fcberl\u00e4ufen und einer Ressourcenersch\u00f6pfung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, falsche Informationen darzustellen und einen Denial-of-Service-Zustand zu verursachen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646",
          "T000126",
          "398363",
          "T012167",
          "T004914"
        ]
      },
      "release_date": "2022-04-05T22:00:00Z",
      "title": "CVE-2022-24713"
    },
    {
      "cve": "CVE-2022-28281",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Thunderbird. Die Fehler bestehen aufgrund von mehreren Use-after-free-Fehlern, einem Out-of-bounds-Write, einer fehlenden Sicherheits\u00fcberpr\u00fcfung, einem Out-of-bounds-Read, einem Spoofing-Angriff, einem Fehler in der Ressourcenverwaltung, mehreren Puffer\u00fcberl\u00e4ufen und einer Ressourcenersch\u00f6pfung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, falsche Informationen darzustellen und einen Denial-of-Service-Zustand zu verursachen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646",
          "T000126",
          "398363",
          "T012167",
          "T004914"
        ]
      },
      "release_date": "2022-04-05T22:00:00Z",
      "title": "CVE-2022-28281"
    },
    {
      "cve": "CVE-2022-28282",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Thunderbird. Die Fehler bestehen aufgrund von mehreren Use-after-free-Fehlern, einem Out-of-bounds-Write, einer fehlenden Sicherheits\u00fcberpr\u00fcfung, einem Out-of-bounds-Read, einem Spoofing-Angriff, einem Fehler in der Ressourcenverwaltung, mehreren Puffer\u00fcberl\u00e4ufen und einer Ressourcenersch\u00f6pfung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, falsche Informationen darzustellen und einen Denial-of-Service-Zustand zu verursachen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646",
          "T000126",
          "398363",
          "T012167",
          "T004914"
        ]
      },
      "release_date": "2022-04-05T22:00:00Z",
      "title": "CVE-2022-28282"
    },
    {
      "cve": "CVE-2022-28283",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Thunderbird. Die Fehler bestehen aufgrund von mehreren Use-after-free-Fehlern, einem Out-of-bounds-Write, einer fehlenden Sicherheits\u00fcberpr\u00fcfung, einem Out-of-bounds-Read, einem Spoofing-Angriff, einem Fehler in der Ressourcenverwaltung, mehreren Puffer\u00fcberl\u00e4ufen und einer Ressourcenersch\u00f6pfung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, falsche Informationen darzustellen und einen Denial-of-Service-Zustand zu verursachen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646",
          "T000126",
          "398363",
          "T012167",
          "T004914"
        ]
      },
      "release_date": "2022-04-05T22:00:00Z",
      "title": "CVE-2022-28283"
    },
    {
      "cve": "CVE-2022-28284",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Thunderbird. Die Fehler bestehen aufgrund von mehreren Use-after-free-Fehlern, einem Out-of-bounds-Write, einer fehlenden Sicherheits\u00fcberpr\u00fcfung, einem Out-of-bounds-Read, einem Spoofing-Angriff, einem Fehler in der Ressourcenverwaltung, mehreren Puffer\u00fcberl\u00e4ufen und einer Ressourcenersch\u00f6pfung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, falsche Informationen darzustellen und einen Denial-of-Service-Zustand zu verursachen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646",
          "T000126",
          "398363",
          "T012167",
          "T004914"
        ]
      },
      "release_date": "2022-04-05T22:00:00Z",
      "title": "CVE-2022-28284"
    },
    {
      "cve": "CVE-2022-28285",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Thunderbird. Die Fehler bestehen aufgrund von mehreren Use-after-free-Fehlern, einem Out-of-bounds-Write, einer fehlenden Sicherheits\u00fcberpr\u00fcfung, einem Out-of-bounds-Read, einem Spoofing-Angriff, einem Fehler in der Ressourcenverwaltung, mehreren Puffer\u00fcberl\u00e4ufen und einer Ressourcenersch\u00f6pfung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, falsche Informationen darzustellen und einen Denial-of-Service-Zustand zu verursachen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646",
          "T000126",
          "398363",
          "T012167",
          "T004914"
        ]
      },
      "release_date": "2022-04-05T22:00:00Z",
      "title": "CVE-2022-28285"
    },
    {
      "cve": "CVE-2022-28286",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Thunderbird. Die Fehler bestehen aufgrund von mehreren Use-after-free-Fehlern, einem Out-of-bounds-Write, einer fehlenden Sicherheits\u00fcberpr\u00fcfung, einem Out-of-bounds-Read, einem Spoofing-Angriff, einem Fehler in der Ressourcenverwaltung, mehreren Puffer\u00fcberl\u00e4ufen und einer Ressourcenersch\u00f6pfung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, falsche Informationen darzustellen und einen Denial-of-Service-Zustand zu verursachen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646",
          "T000126",
          "398363",
          "T012167",
          "T004914"
        ]
      },
      "release_date": "2022-04-05T22:00:00Z",
      "title": "CVE-2022-28286"
    },
    {
      "cve": "CVE-2022-28287",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Thunderbird. Die Fehler bestehen aufgrund von mehreren Use-after-free-Fehlern, einem Out-of-bounds-Write, einer fehlenden Sicherheits\u00fcberpr\u00fcfung, einem Out-of-bounds-Read, einem Spoofing-Angriff, einem Fehler in der Ressourcenverwaltung, mehreren Puffer\u00fcberl\u00e4ufen und einer Ressourcenersch\u00f6pfung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, falsche Informationen darzustellen und einen Denial-of-Service-Zustand zu verursachen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646",
          "T000126",
          "398363",
          "T012167",
          "T004914"
        ]
      },
      "release_date": "2022-04-05T22:00:00Z",
      "title": "CVE-2022-28287"
    },
    {
      "cve": "CVE-2022-28288",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Thunderbird. Die Fehler bestehen aufgrund von mehreren Use-after-free-Fehlern, einem Out-of-bounds-Write, einer fehlenden Sicherheits\u00fcberpr\u00fcfung, einem Out-of-bounds-Read, einem Spoofing-Angriff, einem Fehler in der Ressourcenverwaltung, mehreren Puffer\u00fcberl\u00e4ufen und einer Ressourcenersch\u00f6pfung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, falsche Informationen darzustellen und einen Denial-of-Service-Zustand zu verursachen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646",
          "T000126",
          "398363",
          "T012167",
          "T004914"
        ]
      },
      "release_date": "2022-04-05T22:00:00Z",
      "title": "CVE-2022-28288"
    },
    {
      "cve": "CVE-2022-28289",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Thunderbird. Die Fehler bestehen aufgrund von mehreren Use-after-free-Fehlern, einem Out-of-bounds-Write, einer fehlenden Sicherheits\u00fcberpr\u00fcfung, einem Out-of-bounds-Read, einem Spoofing-Angriff, einem Fehler in der Ressourcenverwaltung, mehreren Puffer\u00fcberl\u00e4ufen und einer Ressourcenersch\u00f6pfung. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, falsche Informationen darzustellen und einen Denial-of-Service-Zustand zu verursachen. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646",
          "T000126",
          "398363",
          "T012167",
          "T004914"
        ]
      },
      "release_date": "2022-04-05T22:00:00Z",
      "title": "CVE-2022-28289"
    }
  ]
}

cve-2022-1196

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-02 23:55

Severity ?

Summary

After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8 and Firefox ESR < 91.8.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2022-14/
	https://www.mozilla.org/security/advisories/mfsa2022-15/
	https://bugzilla.mozilla.org/show_bug.cgi?id=1750679

Impacted products

Vendor

Product

Version

▼

Version: unspecified < 91.8

Firefox ESR

Version: unspecified < 91.8

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:55:24.383Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-14/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1750679"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "91.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "91.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird \u003c 91.8 and Firefox ESR \u003c 91.8."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use-after-free after VR Process destruction",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-22T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-14/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1750679"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-1196",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-03-31T00:00:00",
    "dateUpdated": "2024-08-02T23:55:24.383Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-28285

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-03 05:48

Severity ?

Summary

When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conjunction with another vulnerability this could have been used for an out of bounds memory read. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2022-13/
	https://www.mozilla.org/security/advisories/mfsa2022-14/
	https://www.mozilla.org/security/advisories/mfsa2022-15/
	https://bugzilla.mozilla.org/show_bug.cgi?id=1756957

Impacted products

Vendor

Product

Version

▼

Version: unspecified < 91.8

	Mozilla	Firefox	Version: unspecified < 99
	Mozilla	Firefox ESR	Version: unspecified < 91.8

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:48:37.931Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-14/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1756957"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "91.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "99",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "91.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When generating the assembly code for \u003ccode\u003eMLoadTypedArrayElementHole\u003c/code\u003e, an incorrect AliasSet was used. In conjunction with another vulnerability this could have been used for an out of bounds memory read. This vulnerability affects Thunderbird \u003c 91.8, Firefox \u003c 99, and Firefox ESR \u003c 91.8."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Incorrect AliasSet used in JIT Codegen",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-22T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-14/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1756957"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-28285",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-03-31T00:00:00",
    "dateUpdated": "2024-08-03T05:48:37.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-28284

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-03 05:48

Severity ?

Summary

SVG's <code><use></code> element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with theirs. This vulnerability affects Firefox < 99.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2022-13/
	https://bugzilla.mozilla.org/show_bug.cgi?id=1754522

Impacted products

Vendor

Product

Version

▼

Version: unspecified < 99

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:48:37.903Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1754522"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "99",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SVG\u0027s \u003ccode\u003e\u0026lt;use\u0026gt;\u003c/code\u003e element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko\u0027s implementation was aligned with theirs. This vulnerability affects Firefox \u003c 99."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Script could be executed via svg\u0027s use element",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-22T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1754522"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-28284",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-03-31T00:00:00",
    "dateUpdated": "2024-08-03T05:48:37.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-28289

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-03 05:48

Severity ?

Summary

Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2022-13/
	https://www.mozilla.org/security/advisories/mfsa2022-14/
	https://www.mozilla.org/security/advisories/mfsa2022-15/
	https://bugzilla.mozilla.org/buglist.cgi?bug_id=1663508%2C1744525%2C1753508%2C1757476%2C1757805%2C1758549%2C1758776

Impacted products

Vendor

Product

Version

▼

Version: unspecified < 91.8

	Mozilla	Firefox	Version: unspecified < 99
	Mozilla	Firefox ESR	Version: unspecified < 91.8

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:48:37.941Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-14/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1663508%2C1744525%2C1753508%2C1757476%2C1757805%2C1758549%2C1758776"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "91.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "99",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "91.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 91.8, Firefox \u003c 99, and Firefox ESR \u003c 91.8."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Memory safety bugs fixed in Thunderbird 91.8",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-22T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-14/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
        },
        {
          "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1663508%2C1744525%2C1753508%2C1757476%2C1757805%2C1758549%2C1758776"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-28289",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-03-31T00:00:00",
    "dateUpdated": "2024-08-03T05:48:37.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-1197

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-02 23:55

Severity ?

Summary

When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird < 91.8.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2022-15/
	https://bugzilla.mozilla.org/show_bug.cgi?id=1754985

Impacted products

Vendor

Product

Version

▼

Version: unspecified < 91.8

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:55:24.230Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1754985"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "91.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn\u0027t specify a revocation reason, were unaffected. This vulnerability affects Thunderbird \u003c 91.8."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "OpenPGP revocation information was ignored",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-22T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1754985"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-1197",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-03-31T00:00:00",
    "dateUpdated": "2024-08-02T23:55:24.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-24713

Vulnerability from cvelistv5

Published

2022-03-08 19:00

Modified

2024-08-03 04:20

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API. Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes. All versions of the regex crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from regex 1.5.5. All users accepting user-controlled regexes are recommended to upgrade immediately to the latest version of the regex crate. Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, it us not recommend to deny known problematic regexes.

References

▼	URL	Tags
	https://github.com/rust-lang/regex/security/advisories/GHSA-m5pq-gvj9-9vr8	x_refsource_CONFIRM
	https://github.com/rust-lang/regex/commit/ae70b41d4f46641dbc45c7a4f87954aea356283e	x_refsource_MISC
	https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDOWTHNVGBOP2HN27PUFIGRYNSNDTYRJ/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JANLZ3JXWJR7FSHE57K66UIZUIJZI67T/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3YB7CURSG64CIPCDPNMGPE4UU24AB6H/	vendor-advisory, x_refsource_FEDORA
	https://lists.debian.org/debian-lts-announce/2022/04/msg00003.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2022/dsa-5113	vendor-advisory, x_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2022/04/msg00009.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2022/dsa-5118	vendor-advisory, x_refsource_DEBIAN
	https://security.gentoo.org/glsa/202208-08	vendor-advisory, x_refsource_GENTOO
	https://security.gentoo.org/glsa/202208-14	vendor-advisory, x_refsource_GENTOO

Impacted products

Vendor

Product

Version

▼

rust-lang

regex

Version: < 1.5.5

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:20:50.199Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/rust-lang/regex/security/advisories/GHSA-m5pq-gvj9-9vr8"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rust-lang/regex/commit/ae70b41d4f46641dbc45c7a4f87954aea356283e"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw"
          },
          {
            "name": "FEDORA-2022-ceb3e03c5e",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDOWTHNVGBOP2HN27PUFIGRYNSNDTYRJ/"
          },
          {
            "name": "FEDORA-2022-8436ac4c39",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JANLZ3JXWJR7FSHE57K66UIZUIJZI67T/"
          },
          {
            "name": "FEDORA-2022-d20d44ba98",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3YB7CURSG64CIPCDPNMGPE4UU24AB6H/"
          },
          {
            "name": "[debian-lts-announce] 20220407 [SECURITY] [DLA 2971-1] firefox-esr security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00003.html"
          },
          {
            "name": "DSA-5113",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5113"
          },
          {
            "name": "[debian-lts-announce] 20220411 [SECURITY] [DLA 2978-1] thunderbird security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00009.html"
          },
          {
            "name": "DSA-5118",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5118"
          },
          {
            "name": "GLSA-202208-08",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202208-08"
          },
          {
            "name": "GLSA-202208-14",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202208-14"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "regex",
          "vendor": "rust-lang",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.5.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it\u0027s considered part of the crate\u0027s API. Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it\u0027s possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes. All versions of the regex crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from regex 1.5.5. All users accepting user-controlled regexes are recommended to upgrade immediately to the latest version of the regex crate. Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, it us not recommend to deny known problematic regexes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-10T05:12:38",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rust-lang/regex/security/advisories/GHSA-m5pq-gvj9-9vr8"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rust-lang/regex/commit/ae70b41d4f46641dbc45c7a4f87954aea356283e"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw"
        },
        {
          "name": "FEDORA-2022-ceb3e03c5e",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDOWTHNVGBOP2HN27PUFIGRYNSNDTYRJ/"
        },
        {
          "name": "FEDORA-2022-8436ac4c39",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JANLZ3JXWJR7FSHE57K66UIZUIJZI67T/"
        },
        {
          "name": "FEDORA-2022-d20d44ba98",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3YB7CURSG64CIPCDPNMGPE4UU24AB6H/"
        },
        {
          "name": "[debian-lts-announce] 20220407 [SECURITY] [DLA 2971-1] firefox-esr security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00003.html"
        },
        {
          "name": "DSA-5113",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5113"
        },
        {
          "name": "[debian-lts-announce] 20220411 [SECURITY] [DLA 2978-1] thunderbird security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00009.html"
        },
        {
          "name": "DSA-5118",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5118"
        },
        {
          "name": "GLSA-202208-08",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202208-08"
        },
        {
          "name": "GLSA-202208-14",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202208-14"
        }
      ],
      "source": {
        "advisory": "GHSA-m5pq-gvj9-9vr8",
        "discovery": "UNKNOWN"
      },
      "title": "Regular expression denial of service in Rust\u0027s regex crate",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-24713",
          "STATE": "PUBLIC",
          "TITLE": "Regular expression denial of service in Rust\u0027s regex crate"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "regex",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.5.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "rust-lang"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it\u0027s considered part of the crate\u0027s API. Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it\u0027s possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes. All versions of the regex crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from regex 1.5.5. All users accepting user-controlled regexes are recommended to upgrade immediately to the latest version of the regex crate. Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, it us not recommend to deny known problematic regexes."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-400: Uncontrolled Resource Consumption"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/rust-lang/regex/security/advisories/GHSA-m5pq-gvj9-9vr8",
              "refsource": "CONFIRM",
              "url": "https://github.com/rust-lang/regex/security/advisories/GHSA-m5pq-gvj9-9vr8"
            },
            {
              "name": "https://github.com/rust-lang/regex/commit/ae70b41d4f46641dbc45c7a4f87954aea356283e",
              "refsource": "MISC",
              "url": "https://github.com/rust-lang/regex/commit/ae70b41d4f46641dbc45c7a4f87954aea356283e"
            },
            {
              "name": "https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw",
              "refsource": "MISC",
              "url": "https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw"
            },
            {
              "name": "FEDORA-2022-ceb3e03c5e",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PDOWTHNVGBOP2HN27PUFIGRYNSNDTYRJ/"
            },
            {
              "name": "FEDORA-2022-8436ac4c39",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JANLZ3JXWJR7FSHE57K66UIZUIJZI67T/"
            },
            {
              "name": "FEDORA-2022-d20d44ba98",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O3YB7CURSG64CIPCDPNMGPE4UU24AB6H/"
            },
            {
              "name": "[debian-lts-announce] 20220407 [SECURITY] [DLA 2971-1] firefox-esr security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00003.html"
            },
            {
              "name": "DSA-5113",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5113"
            },
            {
              "name": "[debian-lts-announce] 20220411 [SECURITY] [DLA 2978-1] thunderbird security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00009.html"
            },
            {
              "name": "DSA-5118",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5118"
            },
            {
              "name": "GLSA-202208-08",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202208-08"
            },
            {
              "name": "GLSA-202208-14",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202208-14"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-m5pq-gvj9-9vr8",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-24713",
    "datePublished": "2022-03-08T19:00:12",
    "dateReserved": "2022-02-10T00:00:00",
    "dateUpdated": "2024-08-03T04:20:50.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-28281

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-03 05:48

Severity ?

Summary

If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2022-13/
	https://www.mozilla.org/security/advisories/mfsa2022-14/
	https://www.mozilla.org/security/advisories/mfsa2022-15/
	https://bugzilla.mozilla.org/show_bug.cgi?id=1755621

Impacted products

Vendor

Product

Version

▼

Version: unspecified < 91.8

	Mozilla	Firefox	Version: unspecified < 99
	Mozilla	Firefox ESR	Version: unspecified < 91.8

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:48:37.901Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-14/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1755621"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "91.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "99",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "91.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 91.8, Firefox \u003c 99, and Firefox ESR \u003c 91.8."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Out of bounds write due to unexpected WebAuthN Extensions",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-22T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-14/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1755621"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-28281",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-03-31T00:00:00",
    "dateUpdated": "2024-08-03T05:48:37.901Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-28287

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-03 05:48

Severity ?

Summary

In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. This vulnerability affects Firefox < 99.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2022-13/
	https://bugzilla.mozilla.org/show_bug.cgi?id=1741515

Impacted products

Vendor

Product

Version

▼

Version: unspecified < 99

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:48:37.684Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1741515"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "99",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. This vulnerability affects Firefox \u003c 99."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Text Selection could crash Firefox",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-22T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1741515"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-28287",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-03-31T00:00:00",
    "dateUpdated": "2024-08-03T05:48:37.684Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-28283

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-03 05:48

Severity ?

Summary

The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should have been inaccessible. This vulnerability affects Firefox < 99.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2022-13/
	https://bugzilla.mozilla.org/show_bug.cgi?id=1754066

Impacted products

Vendor

Product

Version

▼

Version: unspecified < 99

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:48:37.695Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1754066"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "99",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should have been inaccessible. This vulnerability affects Firefox \u003c 99."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Missing security checks for fetching sourceMapURL",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-22T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1754066"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-28283",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-03-31T00:00:00",
    "dateUpdated": "2024-08-03T05:48:37.695Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-28286

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-03 05:48

Severity ?

Summary

Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2022-13/
	https://www.mozilla.org/security/advisories/mfsa2022-14/
	https://www.mozilla.org/security/advisories/mfsa2022-15/
	https://bugzilla.mozilla.org/show_bug.cgi?id=1735265

Impacted products

Vendor

Product

Version

▼

Version: unspecified < 91.8

	Mozilla	Firefox	Version: unspecified < 99
	Mozilla	Firefox ESR	Version: unspecified < 91.8

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:48:37.940Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-14/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1735265"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "91.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "99",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "91.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks. This vulnerability affects Thunderbird \u003c 91.8, Firefox \u003c 99, and Firefox ESR \u003c 91.8."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "iframe contents could be rendered outside the border",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-22T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-14/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1735265"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-28286",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-03-31T00:00:00",
    "dateUpdated": "2024-08-03T05:48:37.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-1097

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-02 23:55

Severity ?

Summary

<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2022-13/
	https://www.mozilla.org/security/advisories/mfsa2022-14/
	https://www.mozilla.org/security/advisories/mfsa2022-15/
	https://bugzilla.mozilla.org/show_bug.cgi?id=1745667

Impacted products

Vendor

Product

Version

▼

Version: unspecified < 91.8

	Mozilla	Firefox	Version: unspecified < 99
	Mozilla	Firefox ESR	Version: unspecified < 91.8

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:55:22.820Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-14/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745667"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "91.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "99",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "91.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "\u003ccode\u003eNSSToken\u003c/code\u003e objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird \u003c 91.8, Firefox \u003c 99, and Firefox ESR \u003c 91.8."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use-after-free in NSSToken objects",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-22T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-14/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745667"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-1097",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-03-25T00:00:00",
    "dateUpdated": "2024-08-02T23:55:22.820Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-28288

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-03 05:48

Severity ?

Summary

Mozilla developers and community members Randell Jesup, Sebastian Hengst, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 98. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 99.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2022-13/
	https://bugzilla.mozilla.org/buglist.cgi?bug_id=1746415%2C1746495%2C1746500%2C1747282%2C1748759%2C1749056%2C1749786%2C1751679%2C1752120%2C1756010%2C1756017%2C1757213%2C1757258%2C1757427

Impacted products

Vendor

Product

Version

▼

Version: unspecified < 99

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:48:37.794Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1746415%2C1746495%2C1746500%2C1747282%2C1748759%2C1749056%2C1749786%2C1751679%2C1752120%2C1756010%2C1756017%2C1757213%2C1757258%2C1757427"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "99",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mozilla developers and community members Randell Jesup, Sebastian Hengst, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 98. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 99."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Memory safety bugs fixed in Firefox 99",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-22T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
        },
        {
          "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1746415%2C1746495%2C1746500%2C1747282%2C1748759%2C1749056%2C1749786%2C1751679%2C1752120%2C1756010%2C1756017%2C1757213%2C1757258%2C1757427"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-28288",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-03-31T00:00:00",
    "dateUpdated": "2024-08-03T05:48:37.794Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2022-28282

Vulnerability from cvelistv5

Published

2022-12-22 00:00

Modified

2024-08-03 05:48

Severity ?

Summary

By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object through a freed pointer, leading to a potential exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2022-13/
	https://www.mozilla.org/security/advisories/mfsa2022-14/
	https://www.mozilla.org/security/advisories/mfsa2022-15/
	https://bugzilla.mozilla.org/show_bug.cgi?id=1751609

Impacted products

Vendor

Product

Version

▼

Version: unspecified < 91.8

	Mozilla	Firefox	Version: unspecified < 99
	Mozilla	Firefox ESR	Version: unspecified < 91.8

Show details on NVD website