The vulnerability in the notification interface of the fullscreen UI of Firefox browsers, Firefox ESR, and the Thunderbird email client allows attackers to perform spoofing attacks.

🗓️ 23 May 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Spoofing in fullscreen notification interface on Firefox, ESR, and Thunderbird due to reuse of pop-up windows.

Reporter	Title	Published	Views	Family All 206
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 91.9.0-alt1	4 May 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 91.9.0-alt1	4 May 202200:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud Pak for Multicloud Management Monitoring.	31 Jan 202314:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 102.2ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16 - 2022.4.0	15 Nov 202205:24	–	ibm
Tenable Nessus	Amazon Linux 2 : thunderbird (ALAS-2022-1828)	21 Jul 202200:00	–	nessus
Tenable Nessus	AlmaLinux 8 : firefox (ALSA-2022:1705)	12 May 202200:00	–	nessus
Tenable Nessus	AlmaLinux 8 : thunderbird (ALSA-2022:1730)	12 May 202200:00	–	nessus
Tenable Nessus	AlmaLinux 9 : thunderbird (ALSA-2022:4589)	16 Nov 202200:00	–	nessus
Tenable Nessus	AlmaLinux 9 : firefox (ALSA-2022:4590)	16 Nov 202200:00	–	nessus
Tenable Nessus	CentOS 7 : firefox (RHSA-2022:1703)	6 May 202200:00	–	nessus

Vulners

Node

OR

mozilla firefoxRange<100

mozilla thunderbirdRange<91.9

mozilla firefox_esrRange<91.9

red_hat red_hat_enterprise_linuxMatch7

red_hat red_hat_enterprise_linuxMatch8

red_hat red_hat_enterprise_linuxMatch9

Source	Link
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-16/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-17/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-18/
access	www.access.redhat.com/security/cve/cve-2022-29914
security-tracker	www.security-tracker.debian.org/tracker/CVE-2022-29914
redos	www.redos.red-soft.ru/support/secure/
goslinux	www.goslinux.fssp.gov.ru/2726972/
altsp	www.altsp.su/obnovleniya-bezopasnosti/
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.5/
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti

21 Nov 2023 00:00Current

7.1High risk

Vulners AI Score7.1

CVSS 37.5

CVSS 27.6

EPSS0.0062

fullscreen notification firefox browser firefox esr thunderbird popup window reuse spoofing attack