Improper Authorization in Handler for Custom URL Scheme in Mozilla Firefox - CVE-2022-34478

Vulnerability identifier: #VU64761

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-34478

CWE-ID: CWE-939

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insecure usage of URI handlers that allow usage of ms-msdt, search, and search-ms protocols. A remote attacker can trick the victim to click on a specially crafted link and execute arbitrary code on the system, if the victim accepts the browser prompt.

The vulnerability affects Firefox on Windows.

Mozilla Firefox
Pale Moon
Firefox ESR
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
SUSE Linux Enterprise Storage
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Oracle Solaris
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
Slackware Linux
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Workstation Extension
openSUSE Leap
SUSE Linux Enterprise Module for Packagehub Subpackages
MozillaThunderbird-translations-other
MozillaThunderbird-translations-common
MozillaThunderbird-debugsource
MozillaThunderbird
MozillaThunderbird-debuginfo
MozillaFirefox-debuginfo
MozillaFirefox
MozillaFirefox-translations-common
MozillaFirefox-branding-upstream
MozillaFirefox-debugsource
MozillaFirefox-translations-other
MozillaFirefox-devel
mail-client/thunderbird-bin
mail-client/thunderbird
MozillaFirefox-branding-SLE
Mozilla Thunderbird
IBM Cloud Application Performance Management (APM)

Install updates from vendor's website.

Mozilla Firefox - update to 102.0
Pale Moon - update to 31.1.1
Mozilla Thunderbird - update to 91.11.0
Firefox ESR - update to 91.11.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.16
MozillaThunderbird-translations-other - addressed in versions 91.11.0-150200.8.76.1, 102.2.2-150200.8.82.1
MozillaThunderbird-translations-common - addressed in versions 91.11.0-150200.8.76.1, 102.2.2-150200.8.82.1
MozillaThunderbird-debugsource - addressed in versions 91.11.0-150200.8.76.1, 102.2.2-150200.8.82.1
MozillaThunderbird - addressed in versions 91.11.0-150200.8.76.1, 102.2.2-150200.8.82.1
MozillaThunderbird-debuginfo - addressed in versions 91.11.0-150200.8.76.1, 102.2.2-150200.8.82.1
MozillaFirefox-debuginfo - addressed in versions 91.11.0-150200.152.48.1, 102.2.0-112.130.1, 102.2.0-150000.150.56.1, 102.3.0-150200.152.61.1
MozillaFirefox - addressed in versions 91.11.0-150200.152.48.1, 102.2.0-112.130.1, 102.2.0-150000.150.56.1, 102.3.0-150200.152.61.1
MozillaFirefox-translations-common - addressed in versions 91.11.0-150200.152.48.1, 102.2.0-112.130.1, 102.2.0-150000.150.56.1, 102.3.0-150200.152.61.1
MozillaFirefox-branding-upstream - addressed in versions 91.11.0-150200.152.48.1, 102.3.0-150200.152.61.1
MozillaFirefox-debugsource - addressed in versions 91.11.0-150200.152.48.1, 102.2.0-112.130.1, 102.2.0-150000.150.56.1, 102.3.0-150200.152.61.1
MozillaFirefox-translations-other - addressed in versions 91.11.0-150200.152.48.1, 102.2.0-150000.150.56.1, 102.3.0-150200.152.61.1
MozillaFirefox-devel - addressed in versions 91.11.0-150200.152.48.1, 102.2.0-112.130.1, 102.2.0-150000.150.56.1, 102.3.0-150200.152.61.1
mail-client/thunderbird-bin - update to 91.12.0
mail-client/thunderbird - update to 91.12.0
MozillaFirefox-branding-SLE - addressed in versions 102-35.9.1, 102-150000.4.22.1, 102-150200.9.10.1

• https://www.mozilla.org/en-US/security/advisories/mfsa2022-24/

• Multiple vulnerabilities in Firefox ESR
• Multiple vulnerabilities in Mozilla Firefox
• Multiple vulnerabilities in Mozilla Thunderbird
• Slackware Linux update for mozilla-firefox
• Slackware Linux update for mozilla-thunderbird
• SUSE update for MozillaFirefox
• SUSE update for MozillaThunderbird
• Slackware Linux update for seamonkey
• Gentoo update for Mozilla Firefox
• Gentoo update for Mozilla Thunderbird
• SUSE update for MozillaFirefox
• SUSE update for MozillaFirefox
• SUSE update for MozillaThunderbird
• SUSE update for MozillaFirefox
• Oracle Solaris update for third-party software
• Multiple vulnerabilities in Pale Moon
• Multiple vulnerabilities in IBM Application Performance Management