TI-2022-23225 CVE-2022-46882 · GHSA-qh9q-rjpp-hqc3
Use after free in Mozilla Firefox
Priority MEDIUM 51
A use-after-free in WebGL extensions could have led to a potentially exploitable crash.
RHSA-2022:9072
firefox security update
Released 2022-12-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) firefox-102.6.0-1.el7_9
- Red Hat Enterprise Linux Client Optional (v. 7) firefox-102.6.0-1.el7_9
- Red Hat Enterprise Linux Server (v. 7) firefox-102.6.0-1.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7) firefox-102.6.0-1.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) firefox-102.6.0-1.el7_9
- Red Hat Enterprise Linux Workstation Optional (v. 7) firefox-102.6.0-1.el7_9
Fixes 6 records
TI-2022-23218 CVE-2022-46874 · GHSA-pwwf-7f48-895h
Code injection in Mozilla Firefox
Priority MEDIUM 42
A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place.
TI-2022-23224 CVE-2022-46881 · GHSA-5grf-cv3x-c266
Out-of-bounds write in Mozilla Firefox
Priority MEDIUM 41
An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash.
TI-2022-23221 CVE-2022-46878 · GHSA-3r7c-wgmw-38g7
Out-of-bounds write in Mozilla Firefox
Priority MEDIUM 41
Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.5.
TI-2022-23216 CVE-2022-46872 · GHSA-w696-j5x3-hhvj
Out-of-bounds read in Mozilla Firefox
Priority LOW 39
An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.<br>*This bug only affects Thunderbird for Linux.
TI-2022-23223 CVE-2022-46880 · GHSA-j5r5-jmr3-48c5
Use after free in Mozilla Firefox ESR
Priority LOW 30
A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue.