Buffer overflow in Firefox ESR and Mozilla Thunderbird - CVE-2022-42432

Vulnerability identifier: #VU73749

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-42432

CWE-ID: CWE-120

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to memory safety bugs. A remote unauthenticated attacker can trick the victim into opening a specially crafted file, trigger buffer overflow and execute arbitrary code on the target system.

Firefox ESR
Mozilla Thunderbird
Anolis OS
openEuler
kernel
kernel-debugsource
perf-debuginfo
kernel-source
kernel-devel
kernel-tools-devel
perf
bpftool-debuginfo
kernel-headers
kernel-debuginfo
kernel-tools-debuginfo
bpftool
kernel-tools
python3-perf
python3-perf-debuginfo
kernel-core
kernel-debug
kernel-debug-core
kernel-debug-devel
kernel-debug-modules
kernel-debug-modules-extra
kernel-modules
kernel-modules-extra
kernel-tools-libs
kernel-tools-libs-devel
Dell EMC VxRail Appliance

Install updates from vendor's website.

Firefox ESR - update to 102.4.0
Mozilla Thunderbird - update to 102.4.0
kernel - update to 5.10.0-60.65.0.90
kernel-debugsource - update to 5.10.0-60.65.0.90
perf-debuginfo - update to 5.10.0-60.65.0.90
kernel-source - update to 5.10.0-60.65.0.90
kernel-devel - update to 5.10.0-60.65.0.90
kernel-tools-devel - update to 5.10.0-60.65.0.90
perf - update to 5.10.0-60.65.0.90
bpftool-debuginfo - update to 5.10.0-60.65.0.90
kernel-headers - update to 5.10.0-60.65.0.90
kernel-debuginfo - update to 5.10.0-60.65.0.90
kernel-tools-debuginfo - update to 5.10.0-60.65.0.90
bpftool - update to 5.10.0-60.65.0.90
kernel-tools - update to 5.10.0-60.65.0.90
python3-perf - update to 5.10.0-60.65.0.90
python3-perf-debuginfo - update to 5.10.0-60.65.0.90
bpftool - addressed in versions 5.10.134-15, 5.10.134-16
kernel-headers - addressed in versions 5.10.134-15, 5.10.134-16
kernel - addressed in versions 5.10.134-15, 5.10.134-16
kernel-core - addressed in versions 5.10.134-15, 5.10.134-16
kernel-debug - addressed in versions 5.10.134-15, 5.10.134-16
kernel-debug-core - addressed in versions 5.10.134-15, 5.10.134-16
kernel-debug-devel - addressed in versions 5.10.134-15, 5.10.134-16
kernel-debug-modules - addressed in versions 5.10.134-15, 5.10.134-16
kernel-debug-modules-extra - addressed in versions 5.10.134-15, 5.10.134-16
kernel-devel - addressed in versions 5.10.134-15, 5.10.134-16
kernel-modules - addressed in versions 5.10.134-15, 5.10.134-16
kernel-modules-extra - addressed in versions 5.10.134-15, 5.10.134-16
kernel-tools - addressed in versions 5.10.134-15, 5.10.134-16
kernel-tools-libs - addressed in versions 5.10.134-15, 5.10.134-16
kernel-tools-libs-devel - addressed in versions 5.10.134-15, 5.10.134-16
perf - addressed in versions 5.10.134-15, 5.10.134-16
python3-perf - addressed in versions 5.10.134-15, 5.10.134-16
Dell EMC VxRail Appliance - update to 7.0.411

• https://www.dell.com/support/kbdoc/nl-nl/000211140/dsa-2023-107-dell-vxrail-security-update-for-multiple-third-party-component-vulnerabilities-7-0-xxx

• Multiple vulnerabilities in Dell EMC VxRail Appliance
• openEuler 22.03 LTS update for kernel
• Anolis OS update for kernel(ANCK)5.10
• Anolis OS update for kernel(ANCK)5.10
• Anolis OS update for kernel
• Anolis OS update for kernel