Rewterz Threat Advisory – Multiple Mozilla Firefox and Firefox ESR Vulnerabilities

Severity

High

Analysis Summary

CVE-2022-45419 CVSS:6.5
Mozilla Firefox could provide weaker than expected security, when deleting a security exception fails to effect immediately. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to launch further attacks against the affected system.

CVE-2022-45420 CVSS:8.1
Mozilla Firefox could allow a remote attacker to conduct spoofing attacks, caused by a flaw when using tables inside of an iframe. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to render iframe contents outside the boundaries of the iframe and cause user confusion or perform spoofing attacks.

CVE-2022-45417 CVSS:7.5
Mozilla Firefox could allow a remote attacker to obtain sensitive information, caused by Service Workers not detecting Private Browsing Mode correctly. An attacker could exploit this vulnerability to write Service Workers to disk for websites visited in Private Browsing Mode and use this information to launch further attacks against the affected system.

CVE-2022-45416 CVSS:6.5
Mozilla Firefox could allow a remote attacker to obtain sensitive information, caused by a keystroke Side-Channel Leakage flaw. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to determine which keys were being pressed, and use this information to launch further attacks against the affected system.

CVE-2022-45412 CVSS:8.8
Mozilla Firefox and Firefox ESR could allow a remote attacker to execute arbitrary code on the system, caused by an unitialized memory flaw when resolving a symlink such as file:///proc/self/fd/1. By persuading a victim to visit a specially-crafted symlink, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.

CVE-2022-45411 CVSS:6.5
Mozilla Firefox is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the the Trace method. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.

CVE-2022-45418 CVSS:8.1
Mozilla Firefox could allow a remote attacker to conduct spoofing attacks, caused by a flaw when using a custom mouse cursor and is specified in CSS. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to cause user confusion or perform spoofing attacks.

CVE-2022-45415 CVSS:8.1
Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by a flaw if the title of the page was formatted as a filename with a malicious extension. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to save a malicious extension on the system.

CVE-2022-45410 CVSS:6.5
Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by a flaw when a ServiceWorker intercepted a request with FetchEvent. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to bypass SameSite cookie policy.

CVE-2022-45421 CVSS:8.8
Mozilla Firefox and Firefox ESR could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption flaw. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2022-45406 CVSS:6.5
Mozilla Firefox is vulnerable to a denial of service, caused by a use-after-free flaw when creating a JavaScript global. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to cause the application to crash.

CVE-2022-45413 CVSS:6.5
Mozilla Firefox could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability when using the S.browser_fallback_url parameter parameter. An attacker could exploit this vulnerability using a specially-crafted URL to redirect a victim to arbitrary Web sites and cause SameSite=Strict cookies to be sent.

CVE-2022-45409 CVSS:6.5
Mozilla Firefox is vulnerable to a denial of service, caused by a use-after-free flaw in the garbage collector. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to cause the application to crash.

CVE-2022-45407 CVSS:6.5
Mozilla Firefox is vulnerable to a denial of service, caused by a use-after-free flaw when loading a font using FontFace() on a background worker. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to cause the application to crash.

CVE-2022-45408 CVSS:8.1
Mozilla Firefox could allow a remote attacker to conduct spoofing attacks, caused by a fullscreen notification bypass flaw through a series of popups that reuse windowName. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to cause user confusion or perform spoofing attacks.

CVE-2022-45405 CVSS:6.5
Mozilla Firefox is vulnerable to a denial of service, caused by a use-after-free flaw in the InputStream implementation. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to cause the application to crash.

CVE-2022-45404 CVSS:8.1
Mozilla Firefox could allow a remote attacker to conduct spoofing attacks, caused by a fullscreen notification bypass flaw through a series of popup and window.print() calls. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to cause user confusion or perform spoofing attacks.

Impact

• Denial of Service
• Gain Access
• Information Theft
• Information Disclosure
• Code Execution
• Cross-Site Scripting
• Security Bypass

Indicators Of Compromise

CVE

• CVE-2022-45419
• CVE-2022-45420
• CVE-2022-45417
• CVE-2022-45416
• CVE-2022-45412
• CVE-2022-45411
• CVE-2022-45418
• CVE-2022-45415
• CVE-2022-45410
• CVE-2022-45421
• CVE-2022-45406
• CVE-2022-45413
• CVE-2022-45409
• CVE-2022-45407
• CVE-2022-45408
• CVE-2022-45405
• CVE-2022-45404

Affected Vendors

Mozilla

Affected Products

• Mozilla Firefox 106
• Mozilla Firefox ESR 102.4

Remediation

Refer to Mozilla Foundation Security Advisory for patch, upgrade or suggested workaround information.

Mozilla Foundation Security Advisory