Multiple vulnerabilities in Mozilla Firefox and Firefox ESR
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 8 |
| CVE-ID | CVE-2022-36319 CVE-2022-36314 CVE-2022-36318 CVE-2022-2505 CVE-2022-36317 CVE-2022-36315 CVE-2022-36316 CVE-2022-36320 |
| CWE-ID | CWE-451 CWE-668 CWE-79 CWE-119 CWE-20 CWE-399 CWE-208 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Mozilla Firefox Client/Desktop applications / Web browsers Firefox ESR Client/Desktop applications / Web browsers Firefox for Android Mobile applications / Apps for mobile phones |
| Vendor | Mozilla |
Security Bulletin
This security bulletin contains information about 8 vulnerabilities.
1) Spoofing attack
EUVDB-ID: #VU65793
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-36319
CWE-ID:
CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an error, related to mouse pointer positioning when combining CSS properties for overflow and transform. A remote attacker can trick the victim into interacting with mouse cursor with different coordinates than displayed.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 90.0 - 102.0.1
Firefox ESR: 91.0 - 102.0.1
CPE2.3- cpe:2.3:a:mozilla:mozilla_firefox:90.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:mozilla_firefox:90.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:mozilla_firefox:90.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:91.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:102.0.1:*:*:*:*:*:*:*
http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-30/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-29/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Exposure of Resource to Wrong Sphere
EUVDB-ID: #VU65794
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-36314
CWE-ID:
CWE-668 - Exposure of resource to wrong sphere
Exploit availability: No
DescriptionThe vulnerability allows an attacker to initiate unintended actions.
The vulnerability exists due to an error when opening .lnk shortcuts on the system. If the shortcut contains a link to an external resource the browser can initiate network requests from the operating system.
The vulnerability affects Windows installations only.
Install updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 100.0 - 102.0.1
Firefox ESR: 102.0 - 102.0.1
CPE2.3- cpe:2.3:a:mozilla:mozilla_firefox:100.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:mozilla_firefox:100.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:mozilla_firefox:100.0.2:*:*:*:*:*:*:*
http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-30/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Cross-site scripting
EUVDB-ID: #VU65795
Risk: Medium
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-36318
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when visiting directory listings for chrome:// URLs as source text. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 90.0 - 102.0.1
Firefox ESR: 91.0 - 102.0.1
CPE2.3- cpe:2.3:a:mozilla:mozilla_firefox:90.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:mozilla_firefox:90.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:mozilla_firefox:90.0.2:*:*:*:*:*:*:*
http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-29/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-30/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Buffer overflow
EUVDB-ID: #VU65796
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2022-2505
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 100.0 - 102.0.1
Firefox ESR: 102.0 - 102.0.1
CPE2.3- cpe:2.3:a:mozilla:mozilla_firefox:100.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:mozilla_firefox:100.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:mozilla_firefox:100.0.2:*:*:*:*:*:*:*
http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
http://www.mozilla.org/en-US/security/advisories/mfsa2022-30/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Input validation error
EUVDB-ID: #VU65797
Risk: Medium
CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-36317
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of URLs. A remote attacker can trick the victim to click on a very long link and hang the browser. Due to session restore, this could lead to a permanent Denial of Service.
MitigationInstall updates from vendor's website.
Vulnerable software versionsFirefox for Android: 100.1.0 - 102.2.1
CPE2.3- cpe:2.3:a:mozilla:firefox_for_android:100.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_for_android:100.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_for_android:100.1.2:*:*:*:*:*:*:*
http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Resource management error
EUVDB-ID: #VU65798
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-36315
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to incorrect implementation of the cache preload. When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 100.0 - 102.0.1
CPE2.3- cpe:2.3:a:mozilla:mozilla_firefox:100.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:mozilla_firefox:100.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:mozilla_firefox:100.0.2:*:*:*:*:*:*:*
http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Information Exposure Through Timing Discrepancy
EUVDB-ID: #VU65799
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-36316
CWE-ID:
CWE-208 - Information Exposure Through Timing Discrepancy
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the way Performance API handles cross-site redirects. A remote attacker can observe differences between PerformanceEntries and learn whether the target URL had been subject to a redirect.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 100.0 - 102.0.1
CPE2.3- cpe:2.3:a:mozilla:mozilla_firefox:100.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:mozilla_firefox:100.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:mozilla_firefox:100.0.2:*:*:*:*:*:*:*
http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Buffer overflow
EUVDB-ID: #VU65800
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2022-36320
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 100.0 - 102.0.1
CPE2.3- cpe:2.3:a:mozilla:mozilla_firefox:100.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:mozilla_firefox:100.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:mozilla_firefox:100.0.2:*:*:*:*:*:*:*
http://www.mozilla.org/en-US/security/advisories/mfsa2022-28/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
