Vulnerability of Firefox web browsers, Firefox ESR, and Thunderbird email client, related to deficiencies in access control, allowing attackers to bypass existing security restrictions

🗓️ 23 May 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Access control flaws in Firefox browser, its extended support release, and Thunderbird allow remote bypass of security restrictions.

Reporter	Title	Published	Views	Family All 205
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 91.9.0-alt1	4 May 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 91.9.0-alt1	4 May 202200:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud Pak for Multicloud Management Monitoring.	31 Jan 202314:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 102.2ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16 - 2022.4.0	15 Nov 202205:24	–	ibm
Tenable Nessus	AlmaLinux 8 : firefox (ALSA-2022:1705)	12 May 202200:00	–	nessus
Tenable Nessus	AlmaLinux 8 : thunderbird (ALSA-2022:1730)	12 May 202200:00	–	nessus
Tenable Nessus	AlmaLinux 9 : thunderbird (ALSA-2022:4589)	16 Nov 202200:00	–	nessus
Tenable Nessus	AlmaLinux 9 : firefox (ALSA-2022:4590)	16 Nov 202200:00	–	nessus
Tenable Nessus	CentOS 7 : firefox (RHSA-2022:1703)	6 May 202200:00	–	nessus
Tenable Nessus	CentOS 7 : thunderbird (RHSA-2022:1725)	6 May 202200:00	–	nessus

Vulners

Node

OR

mozilla firefoxRange<100

mozilla thunderbirdRange<91.9

mozilla firefox_esrRange<91.9

red_hat red_hat_enterprise_linuxMatch7

red_hat red_hat_enterprise_linuxMatch8

red_hat red_hat_enterprise_linuxMatch9

Source	Link
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-16/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-17/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-18/
access	www.access.redhat.com/security/cve/CVE-2022-29909
security-tracker	www.security-tracker.debian.org/tracker/CVE-2022-29909
redos	www.redos.red-soft.ru/support/secure/
goslinux	www.goslinux.fssp.gov.ru/2726972/
altsp	www.altsp.su/obnovleniya-bezopasnosti/
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.5/
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti

21 Nov 2023 00:00Current

7.7High risk

Vulners AI Score7.7

CVSS 37.5

CVSS 27.6

EPSS0.00855

Firefox browser Extended support release Thunderbird email client