Risk | High |
Patch available | YES |
Number of vulnerabilities | 7 |
CVE-ID | CVE-2022-46871 CVE-2022-46872 CVE-2022-46873 CVE-2022-46874 CVE-2022-46877 CVE-2022-46878 CVE-2022-46879 |
CWE-ID | CWE-119 CWE-254 CWE-20 CWE-357 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Ubuntu Operating systems & Components / Operating system firefox (Ubuntu package) Operating systems & Components / Operating system package or component |
Vendor | Canonical Ltd. |
Security Bulletin
This security bulletin contains information about 7 vulnerabilities.
EUVDB-ID: #VU70145
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-46871
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in libusrsctp. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 108.0.1+build1-0ubuntu0.20.04.1
External linkshttp://ubuntu.com/security/notices/USN-5782-2
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU70146
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-46872
CWE-ID:
CWE-254 - Security Features
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to unspecified error on Linux installations. A remote attacker who compromised content process can escaped the sandbox and read arbitrary files via clipboard-related IPC messages.
MitigationUpdate the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 108.0.1+build1-0ubuntu0.20.04.1
External linkshttp://ubuntu.com/security/notices/USN-5782-2
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU70153
Risk: Medium
CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-46873
CWE-ID:
CWE-254 - Security Features
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to missing implementation of the unsafe-hashes
CSP directive. A remote attacker can leverage such browser behavior to inject and execute potentially dangerous scripts.
Update the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 108.0.1+build1-0ubuntu0.20.04.1
External linkshttp://ubuntu.com/security/notices/USN-5782-2
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU70147
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-46874
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a spoofing attack.
The vulnerability exists due to insufficient validation of long filenames during drag and drop actions, which causes filename truncation to a potentially malicious extension. A remote attacker can trick the victim to download a file with a long filename, which can be automatically truncated by the browser into an executable file.
Update the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 108.0.1+build1-0ubuntu0.20.04.1
External linkshttp://ubuntu.com/security/notices/USN-5782-2
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU70154
Risk: Medium
CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-46877
CWE-ID:
CWE-357 - Insufficient UI Warning of Dangerous Operations
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to the way fullscreen notifications are displayed by the browser. A remote attacker can confuse browser to delay or suppress fullscreen notifications and perform spoofing attack.
Update the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 108.0.1+build1-0ubuntu0.20.04.1
External linkshttp://ubuntu.com/security/notices/USN-5782-2
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU70149
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-46878
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 108.0.1+build1-0ubuntu0.20.04.1
External linkshttp://ubuntu.com/security/notices/USN-5782-2
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU70155
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-46879
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package firefox to the latest version.
Vulnerable software versionsUbuntu: 18.04 - 20.04
firefox (Ubuntu package): before 108.0.1+build1-0ubuntu0.20.04.1
External linkshttp://ubuntu.com/security/notices/USN-5782-2
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.