Read the docs
Red Hat Security Advisory

RHSA-2022:6701

firefox security update

Released 2022-09-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 7 records

TI-2022-03017 CVE-2022-3266 · GHSA-m3h7-qq8m-r923

Out-of-bounds read in Mozilla Firefox ESR

Priority MEDIUM 58

An out-of-bounds read can occur when decoding H264 video.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00304 Published 2022-12-22 Partial fix · 102.3, 105 CWE-125
TI-2022-19505 CVE-2022-40962 · GHSA-wcx8-5vxf-rv69

Out-of-bounds write in Mozilla Firefox ESR

Priority MEDIUM 43

Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0143 Published 2022-12-22 Partial fix · 102.3, 105 CWE-787
TI-2022-19502 CVE-2022-40959 · GHSA-pc7h-fmrf-pp2j

Insecure storage of sensitive information in Mozilla Firefox ESR

Priority LOW 32

During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0146 Published 2022-12-22 Partial fix · 102.3, 105 CWE-922
TI-2022-19503 CVE-2022-40960 · GHSA-w7vf-mp9x-925q

Use after free in Mozilla Firefox ESR

Priority LOW 31

Concurrent use of the URL parser with non-UTF-8 data was not thread-safe.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01077 Published 2022-12-22 Partial fix · 102.3, 105 CWE-416
TI-2022-19501 CVE-2022-40958 · GHSA-7mxj-29p2-6g84

Injection in Mozilla Firefox ESR

Priority LOW 31

By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other att…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01177 Published 2022-12-22 Partial fix · 102.3, 105 CWE-74
TI-2022-19499 CVE-2022-40956 · GHSA-74v3-gjvq-vv7f

Cross-site scripting in Mozilla Firefox ESR

Priority LOW 29

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00942 Published 2022-12-22 Partial fix · 102.3, 105 CWE-79