SUSE-SU-2022:2313-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 91.11.0 ESR MFSA 2022-25 bsc1200793: - CVE-2022-2200: Undesired attributes could be set as part of prototype pollution bmo1771381 - CVE-2022-31744: CSP bypass enabling stylesheet injection...

SUSE-SU-2022:2289-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 91.11.0 ESR MFSA 2022-25 bsc1200793: - CVE-2022-2200: Undesired attributes could be set as part of prototype pollution bmo1771381 - CVE-2022-31744: CSP bypass enabling stylesheet injection...

SUSE-SU-2022:2279-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 91.11.0 ESR MFSA 2022-25 bsc1200793: - CVE-2022-2200: Undesired attributes could be set as part of prototype pollution bmo1771381 - CVE-2022-31744: CSP bypass enabling stylesheet injection...

The vulnerability of Thunderbird email client, Firefox and Firefox ESR browsers, related to errors in processing the header of the isolated programming environment CSP without the “allow-scenarios” parameter, allows a hacker to circumvent the implemented CSP restrictions and execute any desired scenario.

The vulnerability of the Thunderbird email client, as well as browsers Firefox and Firefox ESR, is related to errors in processing the header of the isolated programming environment CSP, without the “allow-scenarios” parameter. Exploiting this vulnerability allows a remote attacker to circumvent...

Updated thunderbird packages fix security vulnerability

A popup window could be resized in a way to overlay the address bar with web content. CVE-2022-34479 Use-after-free in nsSHistory. CVE-2022-34470 CSP sandbox header without allow-scripts can be bypassed via retargeted javascript: URI. CVE-2022-34468 An email with a mismatching OpenPGP signature...

MGASA-2022-0253 Updated thunderbird packages fix security vulnerability

A popup window could be resized in a way to overlay the address bar with web content. CVE-2022-34479 Use-after-free in nsSHistory. CVE-2022-34470 CSP sandbox header without allow-scripts can be bypassed via retargeted javascript: URI. CVE-2022-34468 An email with a mismatching OpenPGP signature...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2022:5479)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:5479-1 advisory. - Mozilla: CSP sandbox header without allow-scripts can be bypassed via retargeted javascript: URI CVE-2022-34468 - Mozilla: Use-after-free in...

Mozilla: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI

The Mozilla Foundation Security Advisory describes this flaw as: An iframe that was not permitted to run scripts could do so if the user clicked on a javascript: link...

Mozilla: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI

The Mozilla Foundation Security Advisory describes this flaw as: An iframe that was not permitted to run scripts could do so if the user clicked on a javascript: link...

RHEL 8 : firefox (RHSA-2022:5474)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5474 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

RHEL 9 : thunderbird (RHSA-2022:5482)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5482 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.11. Security Fixes: Mozilla: C...

RHEL 9 : firefox (RHSA-2022:5481)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5481 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

ROS-20220701-02

A vulnerability in the Mozilla Firefox browser is related to improper handling of the CSP sandbox header without the the "allow scripts" parameter. Exploitation of the vulnerability could allow an attacker acting remotely to use an iframe to bypass an implemented CSP restriction and exploit it...

RHEL 7 : firefox (RHSA-2022:5479)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5479 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

RHEL 8 : thunderbird (RHSA-2022:5473)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5473 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.11. Security Fixes: Mozilla: C...

RHEL 8 : thunderbird (RHSA-2022:5470)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5470 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.11. Security Fixes: Mozilla: C...

RHEL 8 : firefox (RHSA-2022:5477)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5477 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

RHEL 8 : firefox (RHSA-2022:5472)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5472 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

Authentication Bypass

firefox is vulnerable to authentication bypass. The vulnerability exists the csp sandbox headers are not properly handled which allows an attacker to bypass iframe via retargeted javascript...

Mozilla: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI

The Mozilla Foundation Security Advisory describes this flaw as: An iframe that was not permitted to run scripts could do so if the user clicked on a javascript: link...