1. Home
  2. Security Advisories
  3. Mozilla
  4. MFSA-2022-09

[MFSA-2022-09] Security Vulnerabilities fixed in Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3.0, and Focus 97.3.0

Severity High
Affected Packages 5
Fixed Packages 5
CVEs 2
Info Packages References Vulnerabilities

  • CVE-2022-26485: Use-after-free in XSLT parameter processing (critical)
    Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw.

  • CVE-2022-26486: Use-after-free in WebGPU IPC Framework (critical)
    An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw.

Package Affected Version
pkg:mozilla/Thunderbird < 91.6.2
pkg:mozilla/Firefox?os=android < 97.3.0
pkg:mozilla/Firefox%20Focus < 97.3.0
pkg:mozilla/Firefox%20ESR < 91.6.1
pkg:mozilla/Firefox < 97.0.2
Package Fixed Version
pkg:mozilla/Thunderbird = 91.6.2
pkg:mozilla/Firefox?os=android = 97.3.0
pkg:mozilla/Firefox%20Focus = 97.3.0
pkg:mozilla/Firefox%20ESR = 91.6.1
pkg:mozilla/Firefox = 97.0.2
ID
MFSA-2022-09
Severity
high
URL
https://www.mozilla.org/en-US/security/advisories/mfsa2022-09
Published
2022-03-05T00:00:00
(2 years ago)
Modified
2022-03-05T00:00:00
(2 years ago)
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:mozilla/Thunderbird Thunderbird < 91.6.2
Fixed pkg:mozilla/Thunderbird Thunderbird = 91.6.2
Affected pkg:mozilla/Firefox?os=android Firefox < 97.3.0
Fixed pkg:mozilla/Firefox?os=android Firefox = 97.3.0
Affected pkg:mozilla/Firefox%20Focus Firefox Focus < 97.3.0
Fixed pkg:mozilla/Firefox%20Focus Firefox Focus = 97.3.0
Affected pkg:mozilla/Firefox%20ESR Firefox ESR < 91.6.1
Fixed pkg:mozilla/Firefox%20ESR Firefox ESR = 91.6.1
Affected pkg:mozilla/Firefox Firefox < 97.0.2
Fixed pkg:mozilla/Firefox Firefox = 97.0.2
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date