CERT-In Vulnerability Note
CIVN-2022-0479
Multiple Vulnerabilities in Mozilla Products
Original Issue Date:December 16, 2022
Severity Rating: HIGH
Software Affected
- Mozilla Firefox versions prior to 108
- Mozilla Firefox ESR versions prior to 102.6
- Mozilla Thunderbird versions prior to 102.6
Overview
Multiple vulnerabilities have been reported in Mozilla Firefox, Mozilla Thunderbird and Mozilla Firefox ESR which could be exploited by a remote attacker to perform spoofing attack, execute arbitrary code, bypass security restrictions, gain access to potentially sensitive information, perform memory corruption and a potentially exploitable crash on the targeted system.
Description
These vulnerabilities exist in Mozilla products due to a Use-after-free & Memory corruption in WebGL, Arbitrary file read from a compromised content process like clipboard-related IPC messages (for Linux), Insufficient validation of long filenames extension during drag and drop actions, Bypass of download protections by .atloc and .ftploc files (on Mac OS), libusrsctp library out of date, delay or suppression of fullscreen notification and missing of the unsafe-hashes CSP directive implementation. An attacker could exploit these vulnerabilities by persuading a victim to visit a specially crafted Website. A remote attacker could exploit these vulnerabilities by persuading a victim to visit a specially crafted Web site.
Successful exploitation of these vulnerabilities could allow the remote attacker to perform a spoofing attack, execute arbitrary code, bypass security restrictions, gain access to potentially sensitive information, perform memory corruption and a potentially exploitable crash on the targeted system.
Solution
Apply appropriate fixes as mentioned in Mozilla Security advisories:
https://www.mozilla.org/en-US/security/advisories/mfsa2022-51
https://www.mozilla.org/en-US/security/advisories/mfsa2022-52
https://www.mozilla.org/en-US/security/advisories/mfsa2022-53
Vendor Information
Mozilla
https://www.mozilla.org/en-US/security/advisories/
References
Mozilla
https://www.mozilla.org/en-US/security/advisories/mfsa2022-51
https://www.mozilla.org/en-US/security/advisories/mfsa2022-52
https://www.mozilla.org/en-US/security/advisories/mfsa2022-53
Center for Internet Security
https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-products-could-allow-for-arbitrary-code-execution_2022-140
CVE Name
CVE-2022-46871
CVE-2022-46872
CVE-2022-46873
CVE-2022-46874
CVE-2022-46875
CVE-2022-46877
CVE-2022-46878
CVE-2022-46879
CVE-2022-46880
CVE-2022-46881
CVE-2022-46882
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|