The vulnerabilities of Mozilla Firefox, Mozilla Firefox ESR, and the email client Thunderbird are related to authentication process errors, which allow a perpetrator to disable the installed extensions.

🗓️ 28 Sep 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Firefox, Firefox ESR, and Thunderbird have remote extension disable via authentication and certificate validation.

Reporter	Title	Published	Views	Family All 180
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 78.0.1-alt1	4 Jul 202000:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 68.10.0-alt1	13 Jul 202000:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 78.0-alt1	21 Jul 202000:00	–	altlinux
Tenable Nessus	Amazon Linux 2 : thunderbird (ALAS-2020-1468)	23 Jul 202000:00	–	nessus
Tenable Nessus	Amazon Linux 2 : thunderbird (ALAS-2023-1945)	23 Feb 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : thunderbird (ALAS-2025-2836)	1 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : firefox (CESA-2020:2828)	1 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 6 : firefox (RHSA-2020:2824)	10 Jul 202000:00	–	nessus
Tenable Nessus	CentOS 7 : firefox (RHSA-2020:2827)	10 Jul 202000:00	–	nessus
Tenable Nessus	CentOS 7 : thunderbird (RHSA-2020:2906)	9 Oct 202400:00	–	nessus

Vulners

Node

mozilla firefoxRange<78

OR

mozilla thunderbirdRange<68.10.0

OR

mozilla firefox_esrRange<68.10

OR

red_hat red_hat_enterprise_linuxMatch6

OR

red_hat red_hat_enterprise_linuxMatch7

OR

red_hat red_hat_enterprise_linuxMatch8

OR

novell opensuse_leapMatch15.1

OR

canonical ubuntuMatch19.10

OR

novell opensuse_leapMatch15.2

OR

novell opensuse_leapMatch15.3

OR

novell opensuse_leapMatch15.4

Source	Link
lists	www.lists.opensuse.org/archives/list/[email protected]/message/YAYUZVFPL5N3QXJNFURNBG4J7U6HBKUJ/
lists	www.lists.opensuse.org/archives/list/[email protected]/message/42LJZ4E7FAWVTKPVLPQEJB45C3YAMRAT/
lists	www.lists.opensuse.org/archives/list/[email protected]/message/IC6WAA3I6RVAR7RIOKVD5HFWG5AGB2TV/
lists	www.lists.opensuse.org/archives/list/[email protected]/message/I7VVAECKE6LOD5F2FZICEGZKYEAAKBWU/
bugzilla	www.bugzilla.mozilla.org/show_bug.cgi
security	www.security.gentoo.org/glsa/202007-09
security	www.security.gentoo.org/glsa/202007-10
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2020-24/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2020-25/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2020-26/

16 Sep 2024 00:00Current

7High risk

Vulners AI Score7

CVSS 36.5

CVSS 27.8

EPSS0.01843

firefox firefox esr thunderbird remote extension disable authentication certificate validation