Mozilla: ServiceWorker-intercepted requests bypassed SameSite cookie policy

The Mozilla Foundation Security Advisory describes this flaw as: When a ServiceWorker intercepted a request with FetchEvent, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec...

Mozilla Firefox Input Validation Error Vulnerability (CNVD-2023-15819)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. Mozila Firefox is vulnerable to an input validation error that could be exploited by an attacker to redirect a user to a URL and cause a SameSite=Strict cookie to be sent...

Mozilla Firefox has an unspecified vulnerability (CNVD-2023-15821)

Mozilla Firefox is an open source web browser from the Mozilla Foundation. Mozila Firefox has a security vulnerability that can be exploited by attackers to cause SameSite cookie protection to fail...

RHEL 8 : thunderbird (RHSA-2022:8544)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:8544 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.5.0. Security Fixes: Mozilla:...

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.5.0 ESR. Security Fixes: Mozilla: Service Workers might have learned size of cross-origin media files CVE-2022-45403 Mozilla: Fullscreen...

AlmaLinux 8 : thunderbird (ALSA-2022:8547)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2022:8547 advisory. - Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with...

RHEL 7 : firefox (RHSA-2022:8552)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:8552 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

ALSA-2022:8554 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.5.0 ESR. Security Fixes: Mozilla: Service Workers might have learned size of cross-origin media files CVE-2022-45403 Mozilla: Fullscreen...

Authentication Bypass

firefox is vulnerable to authentication bypass. The vulnerability exists when a ServiceWorker intercepted a request with FetchEvent which allows an attacker to bypass SameSite cookie policy by sending malicious requests...

SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2022:4085-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4085-1 advisory. - Fixed various security issues MFSA 2022-49, bsc1205270: CVE-2022-45403 bmo1762078 Service...

Debian: Security Advisory (DLA-3199-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3199-1] firefox-esr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3199-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort November 17, 2022 https://wiki.debian.org/LTS -...

[SECURITY] [DSA 5282-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5282-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 16, 2022 https://www.debian.org/security/faq -...

CVE-2022-45410

The Mozilla Foundation Security Advisory describes this flaw as: When a ServiceWorker intercepted a request with FetchEvent, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec...

Mozilla Firefox ESR Security Advisories (MFSA2022-47, MFSA2022-49) - Mac OS X

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

CVE-2022-45413

Using the S.browserfallbackurl parameter parameter, an attacker could redirect a user to a URL and cause SameSite=Strict cookies to be sent.This issue only affects Firefox for Android. Other operating systems are not affected.. This vulnerability affects Firefox 107...

CVE-2022-45410

When a ServiceWorker intercepted a request with FetchEvent, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers. This vulnerability affects Firefox ESR...

Mozilla Firefox < 107.0

The version of Firefox installed on the remote Windows host is prior to 107.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-47 advisory. - Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safe...

Mozilla Firefox Security Advisory (MFSA2022-47) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 102.2ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16 - 2022.4.0

Summary Synthetic Playback Agent has addressed the following vulnerabilities: CVE-2022-29912, CVE-2022-38473, CVE-2022-29914, CVE-2022-38476, CVE-2022-38477, CVE-2022-34470, CVE-2022-29911, CVE-2022-29917, CVE-2022-31739, CVE-2022-34481, CVE-2022-38478, CVE-2022-34478, CVE-2022-31738,...