SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2022:0783-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0783-1 advisory. - Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had...

SUSE: Security Advisory (SUSE-SU-2022:0777-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2939-1 : thunderbird - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2939 advisory. Two security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. For Debian 9 stretch, these problems have been fixed in...

Updated thunderbird packages fix security vulnerabilities

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free CVE-2022-26485. An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape CVE-2022-26486...

CVE-2022-26485

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: Removing an XSLT parameter during processing could have led to an exploitable use-after-free issue. There were reports of attacks in the wild abusing this flaw...

Two actively exploited Zero-Day vulnerabilities discovered in Mozilla Firefox

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Two critical zero-day vulnerabilities have been identified in Mozilla Firefox that are being exploited in-the-wild and tracked as CVE-2022-26485 and CVE-2022-26485. Both are use-after-free bugs that exist in XSLT parameter...

PT-2022-2584

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.9.14 libxslt versions prior to 1.1.35 Description The issue is related to integer overflows in several buffer handling functions in buf.c xmlBuf and tree.c xmlBuffer of the libxml2 library. This can result in...

CVE-2022-22834

An issue was discovered in OverIT Geocall before 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XSLT Injection vulnerability. Attackers could exploit this issue to achieve remote code execution...

CVE-2022-22834

CVE-2022-22834 (OverIT Geocall) : The vulnerability exists in OverIT Geocall before version 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can trigger an XSLT Injection, which could lead to remote code execution. Multiple connected sources (including NVD and ...

Critical Firefox Zero-Day Bugs Allow RCE, Sandbox Escape

Mozilla has released an emergency update for its Firefox browser that addresses two critical security vulnerabilities that cybercriminals have actively exploited in the wild as zero days. Both are use-after-free bugs, which are memory-corruption issues that occur when an application continues to...

2 New Mozilla Firefox 0-Day Bugs Under Active Attack — Patch Your Browser ASAP!

Mozilla has pushed out-of-band software updates to its Firefox web browser to contain two high-impact security vulnerabilities, both of which it says are being actively exploited in the wild. Tracked as CVE-2022-26485 and CVE-2022-26486, the zero-day flaws have been described as use-after-free...

PT-2022-15702 · Overit · Overit Geocall

Name of the Vulnerable Software and Affected Versions: OverIT Geocall versions prior to 8.0 Description: An issue was discovered that allows an authenticated user with the Test Trasformazione XSL functionality enabled to exploit a XSLT Injection vulnerability. This could allow attackers to achiev...

Mozilla Firefox Use-After-Free Vulnerability

Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution...

Mozilla Thunderbird < 91.6.2

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.6.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-09 advisory. - An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbo...

Denial Of Service (DoS)

firefox is vulnerable to denial of service. The vulnerability exists due to a use-after-free was discovered when removing an XSLT parameter in some circumstances...

Use After Free

firefox is vulnerable to use-after-free. The vulnerability exists due to a “Use-after-free in XSLT parameter processing”...

Ubuntu 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-5314-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5314-1 advisory. A use-after-free was discovered when removing an XSLT parameter in some circumstances. If a user were tricked into opening a specially crafte...

UBUNTU-CVE-2022-26485

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3.0, Thunderbird 91.6.2, and Focus 97.3.0...

KLA12475 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in XSLT parameter processing can be exploited to cause...

KLA12470 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in XSLT parameter processing can be exploited to cause denial ...