The vulnerability affects the implementation of the XSLT (Extensible Stylesheet Language Transformations) technology in the Thunderbird email client, as well as in the Firefox and Firefox ESR browsers. This vulnerability allows an attacker to escalate their privileges.

🗓️ 02 Sep 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

XSLT flaw in Thunderbird and Firefox enables remote privilege escalation due to layer limits.

Reporter	Title	Published	Views	Family All 241
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 102.2.0-alt1	25 Aug 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 102.2.0-alt1	24 Aug 202200:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud Pak for Multicloud Management Monitoring.	31 Jan 202314:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 102.2ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16 - 2022.4.0	15 Nov 202205:24	–	ibm
Tenable Nessus	Amazon Linux 2 : thunderbird (ALAS-2022-1855)	11 Oct 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2 : firefox (ALASFIREFOX-2023-012)	27 Sep 202300:00	–	nessus
Tenable Nessus	AlmaLinux 8 : thunderbird (ALSA-2022:6164)	31 Aug 202200:00	–	nessus
Tenable Nessus	AlmaLinux 9 : thunderbird (ALSA-2022:6165)	16 Nov 202200:00	–	nessus
Tenable Nessus	AlmaLinux 9 : firefox (ALSA-2022:6174)	16 Nov 202200:00	–	nessus
Tenable Nessus	AlmaLinux 8 : firefox (ALSA-2022:6175)	31 Aug 202200:00	–	nessus

Vulners

Node

mozilla thunderbirdRange<91.13

OR

mozilla firefoxRange<104

OR

mozilla firefox_esrRange102–102.2

OR

mozilla firefox_esrRange<91.13

OR

mozilla thunderbirdRange102–102.2

OR

centos centosMatch7

OR

red_hat red_hat_enterprise_linuxMatch7

OR

red_hat red_hat_enterprise_linuxMatch8

OR

red_hat red_hat_enterprise_linuxMatch9

Source	Link
access	www.access.redhat.com/security/cve/CVE-2022-38473
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-33/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-34/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-35/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-36/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-37/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2022-38473
linuxsecurity	www.linuxsecurity.com/advisories/centos/centos-cesa-2022-6169-important-centos-7-thunderbird-18-01-42
linuxsecurity	www.linuxsecurity.com/advisories/centos/centos-cesa-2022-6179-important-centos-7-firefox-18-00-44
goslinux	www.goslinux.fssp.gov.ru/2726972/

21 Nov 2023 00:00Current

7.5High risk

Vulners AI Score7.5

CVSS 37.5

CVSS 27.6

EPSS0.00684

Extensible Stylesheet Language Thunderbird Firefox Firefox ESR Remote privilege escalation Layer limits