Read the docs
Red Hat Security Advisory

RHSA-2022:1703

firefox security update

Released 2022-05-04 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 6 records

TI-2022-12260 CVE-2022-29909 · GHSA-557q-69q9-3wvh

Incorrect default permissions in Mozilla Thunderbird

Priority HIGH 73

Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00889 Published 2022-12-22 Partial fix · 91.9, 100 CWE-276
TI-2022-12268 CVE-2022-29917 · GHSA-gfq4-pq7x-mq8c

Out-of-bounds write in Mozilla Thunderbird

Priority MEDIUM 51

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR 91.8.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01054 Published 2022-12-22 Partial fix · 91.9, 100 CWE-787
TI-2022-12267 CVE-2022-29916 · GHSA-fv4x-hrpq-wqgp

Information disclosure in Mozilla Thunderbird

Priority LOW 30

Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00758 Published 2022-12-22 Partial fix · 91.9, 100 CWE-200
TI-2022-12265 CVE-2022-29914 · GHSA-wmwv-wgqw-75xr

Clickjacking in Mozilla Thunderbird

Priority LOW 30

When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00661 Published 2022-12-22 Partial fix · 91.9, 100 CWE-1021
TI-2022-12263 CVE-2022-29912 · GHSA-qf7x-w4mc-mcp8

Open redirect in Mozilla Thunderbird

Priority LOW 28

Requests initiated through reader mode did not properly omit cookies with a SameSite attribute.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00675 Published 2022-12-22 Partial fix · 91.9, 100 CWE-601
TI-2022-12262 CVE-2022-29911 · GHSA-2pjx-v75h-827m

Clickjacking in Mozilla Thunderbird

Priority LOW 28

An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00613 Published 2022-12-22 Partial fix · 91.9, 100 CWE-1021