The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird, related to a boundary error in processing an unexpected number of WebAuthN extensions in the Register command, allows a malicious actor to execute arbitrary code.

🗓️ 19 Apr 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 6 Views

Boundary error in WebAuthN extensions during Register enables code execution in Firefox, ESR, and Thunderbird.

Reporter	Title	Published	Views	Family All 188
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 91.8.0-alt1	6 Apr 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 91.8.0-alt1	6 Apr 202200:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud Pak for Multicloud Management Monitoring.	31 Jan 202314:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 91.8.0ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16 - 2022.4.0	29 Apr 202204:43	–	ibm
Tenable Nessus	Amazon Linux 2 : thunderbird (ALAS-2022-1789)	27 Apr 202200:00	–	nessus
Tenable Nessus	CentOS 7 : firefox (RHSA-2022:1284)	9 Oct 202400:00	–	nessus
Tenable Nessus	CentOS 7 : thunderbird (RHSA-2022:1302)	9 Oct 202400:00	–	nessus
Tenable Nessus	Debian DLA-2971-1 : firefox-esr - LTS security update	7 Apr 202200:00	–	nessus
Tenable Nessus	Debian DLA-2978-1 : thunderbird - LTS security update	11 Apr 202200:00	–	nessus
Tenable Nessus	Debian DSA-5113-1 : firefox-esr - security update	7 Apr 202200:00	–	nessus

Vulners

Node

mozilla firefoxRange<99

OR

mozilla firefox_esrRange<91.8

OR

mozilla thunderbirdRange<91.8

OR

red_hat red_hat_enterprise_linuxMatch7

OR

red_hat red_hat_enterprise_linuxMatch8

OR

novell opensuse_leapMatch15.3

OR

canonical ubuntuMatch21.10

OR

novell opensuse_leapMatch15.4

Source	Link
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-15/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-13/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-14/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2022-28281
suse	www.suse.com/security/cve/CVE-2022-28281.html
access	www.access.redhat.com/security/cve/CVE-2022-28281
ubuntu	www.ubuntu.com/security/notices/USN-5370-1
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
goslinux	www.goslinux.fssp.gov.ru/2726972/
altsp	www.altsp.su/obnovleniya-bezopasnosti/

13 Sep 2024 00:00Current

8.1High risk

Vulners AI Score8.1

CVSS 37.5

CVSS 27.6

EPSS0.02556

web authentication extensions handling register command arbitrary code firefox thunderbird