Multiple vulnerabilities in Mozilla Firefox and Firefox ESR
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 8 |
| CVE-ID | CVE-2022-36319 CVE-2022-36314 CVE-2022-36318 CVE-2022-2505 CVE-2022-36317 CVE-2022-36315 CVE-2022-36316 CVE-2022-36320 |
| CWE-ID | CWE-451 CWE-668 CWE-79 CWE-119 CWE-20 CWE-399 CWE-208 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Mozilla Firefox Client/Desktop applications / Web browsers Firefox ESR Client/Desktop applications / Web browsers Firefox for Android Mobile applications / Apps for mobile phones |
| Vendor | Mozilla |
Security Bulletin
This security bulletin contains information about 8 vulnerabilities.
1) Spoofing attack
EUVDB-ID: #VU65793
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2022-36319
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an error, related to mouse pointer positioning when combining CSS properties for overflow and transform. A remote attacker can trick the victim into interacting with mouse cursor with different coordinates than displayed.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 90.0 - 102.0.1
Firefox ESR: 91.0 - 102.0.1
Fixed software versionsCPE2.3 External links
http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-30/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-29/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
2) Exposure of Resource to Wrong Sphere
EUVDB-ID: #VU65794
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2022-36314
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows an attacker to initiate unintended actions.
The vulnerability exists due to an error when opening .lnk shortcuts on the system. If the shortcut contains a link to an external resource the browser can initiate network requests from the operating system.
The vulnerability affects Windows installations only.
Install updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 100.0 - 102.0.1
Firefox ESR: 102.0 - 102.0.1
Fixed software versionsCPE2.3 External links
http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-30/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
3) Cross-site scripting
EUVDB-ID: #VU65795
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2022-36318
CWE-ID:
Exploit availability:
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when visiting directory listings for chrome:// URLs as source text. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 90.0 - 102.0.1
Firefox ESR: 91.0 - 102.0.1
Fixed software versionsCPE2.3 External links
http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-29/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-30/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
4) Buffer overflow
EUVDB-ID: #VU65796
Risk: High
CVSSv3.1:
CVE-ID: CVE-2022-2505
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 100.0 - 102.0.1
Firefox ESR: 102.0 - 102.0.1
Fixed software versionsCPE2.3 External links
http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-30/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
5) Input validation error
EUVDB-ID: #VU65797
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2022-36317
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of URLs. A remote attacker can trick the victim to click on a very long link and hang the browser. Due to session restore, this could lead to a permanent Denial of Service.
MitigationInstall updates from vendor's website.
Vulnerable software versionsFirefox for Android: 100.1.0 - 102.2.1
Fixed software versionsCPE2.3 External links
http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
6) Resource management error
EUVDB-ID: #VU65798
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2022-36315
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to incorrect implementation of the cache preload. When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 100.0 - 102.0.1
Fixed software versionsCPE2.3 External links
http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
7) Information Exposure Through Timing Discrepancy
EUVDB-ID: #VU65799
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2022-36316
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the way Performance API handles cross-site redirects. A remote attacker can observe differences between PerformanceEntries and learn whether the target URL had been subject to a redirect.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 100.0 - 102.0.1
Fixed software versionsCPE2.3 External links
http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
8) Buffer overflow
EUVDB-ID: #VU65800
Risk: High
CVSSv3.1:
CVE-ID: CVE-2022-36320
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 100.0 - 102.0.1
Fixed software versionsCPE2.3 External links
http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
