Critical Firefox Zero-Day Bugs Allow RCE, Sandbox Escape

🗓️ 07 Mar 2022 16:19:15Reported by Tara SealsType

threatpost

threatpost🔗 threatpost.com👁 96 Views

Critical Firefox Zero-Day Bugs Patche

Reporter	Title	Published	Views	Family All 239
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 91.6.1-alt1	11 Mar 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 91.6.2-alt1	15 Mar 202200:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud Pak for Multicloud Management Monitoring.	31 Jan 202314:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 91.8.0ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16 - 2022.4.0	29 Apr 202204:43	–	ibm
ATTACKERKB	CVE-2022-26486	22 Dec 202200:00	–	attackerkb
ATTACKERKB	CVE-2022-26485	22 Dec 202200:00	–	attackerkb
Tenable Nessus	Amazon Linux 2 : thunderbird (ALAS-2022-1779)	27 Apr 202200:00	–	nessus
Tenable Nessus	CentOS 7 : firefox (RHSA-2022:0824)	29 Mar 202200:00	–	nessus
Tenable Nessus	CentOS 7 : thunderbird (RHSA-2022:0850)	29 Mar 202200:00	–	nessus
Tenable Nessus	Debian DLA-2933-1 : firefox-esr - LTS security update	7 Mar 202200:00	–	nessus

Source	Link
firewalls	www.firewalls.com/blog/security-terms/use-free-uaf/
ibm	www.ibm.com/docs/en/was-nd/8.5.5
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-09/
gpuweb	www.gpuweb.github.io/gpuweb/explainer/
nakedsecurity	www.nakedsecurity.sophos.com/2022/03/05/firefox-patches-two-in-the-wild-exploits-update-now/
bit	www.bit.ly/3BXPL6S
bit	www.bit.ly/3BXPL6S

07 Mar 2022 16:19Current

9.4High risk

Vulners AI Score9.4

CVSS 3.19.6

EPSS0.13797

SSVC

firefox zero-day bugs rce sandbox escape use-after-free xslt webgpu mozilla cve-2022-26485 cve-2022-26486