Multiple vulnerabilities in Mozilla Firefox and Firefox ESR



Published: 2022-07-26
Risk High
Patch available YES
Number of vulnerabilities 8
CVE-ID CVE-2022-36319
CVE-2022-36314
CVE-2022-36318
CVE-2022-2505
CVE-2022-36317
CVE-2022-36315
CVE-2022-36316
CVE-2022-36320
CWE-ID CWE-451
CWE-668
CWE-79
CWE-119
CWE-20
CWE-399
CWE-208
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Mozilla Firefox
Client/Desktop applications / Web browsers

Firefox ESR
Client/Desktop applications / Web browsers

Firefox for Android
Mobile applications / Apps for mobile phones

Vendor Mozilla

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Spoofing attack

EUVDB-ID: #VU65793

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-36319

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to an error, related to mouse pointer positioning when combining CSS properties for overflow and transform. A remote attacker can trick the victim into interacting with mouse cursor with different coordinates than displayed.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 90.0 - 102.0.1

Firefox ESR: 102.0 - 102.0.1, 91.0 - 91.11.0


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-30/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-29/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

2) Exposure of Resource to Wrong Sphere

EUVDB-ID: #VU65794

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-36314

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

Exploit availability: No

Description

The vulnerability allows an attacker to initiate unintended actions.

The vulnerability exists due to an error when opening .lnk shortcuts on the system. If the shortcut contains a link to an external resource the browser can initiate network requests from the operating system.

The vulnerability affects Windows installations only.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 100.0 - 102.0.1

Firefox ESR: 102.0 - 102.0.1


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-30/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

3) Cross-site scripting

EUVDB-ID: #VU65795

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-36318

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when visiting directory listings for chrome:// URLs as source text. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 90.0 - 102.0.1

Firefox ESR: 102.0 - 102.0.1, 91.0 - 91.11.0


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-29/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-30/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

4) Buffer overflow

EUVDB-ID: #VU65796

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-2505

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 100.0 - 102.0.1

Firefox ESR: 102.0 - 102.0.1


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-30/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

5) Input validation error

EUVDB-ID: #VU65797

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-36317

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of URLs. A remote attacker can trick the victim to click on a very long link and hang the browser. Due to session restore, this could lead to a permanent Denial of Service.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Firefox for Android: 100.1.0 - 102.2.1


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

6) Resource management error

EUVDB-ID: #VU65798

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-36315

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to incorrect implementation of the cache preload. When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 100.0 - 102.0.1


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

7) Information Exposure Through Timing Discrepancy

EUVDB-ID: #VU65799

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-36316

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the way Performance API handles cross-site redirects. A remote attacker can observe differences between PerformanceEntries and learn whether the target URL had been subject to a redirect.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 100.0 - 102.0.1


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

8) Buffer overflow

EUVDB-ID: #VU65800

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-36320

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 100.0 - 102.0.1


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###