[MFSA-2022-24] Security Vulnerabilities fixed in Firefox 102

Severity High

Affected Packages 1

Fixed Packages 1

CVEs 19

Note*: While [Bug 1771084](https://bugzilla.mozilla.org/show_bug.cgi?id=1771084) does not represent a specific vulnerability that was fixed, we recommend anyone rebasing patches to include it. 102 branch: Patch [1](https://hg.mozilla.org/releases/mozilla-beta/rev/82e3067ad2e7) and [2](https://hg.mozilla.org/releases/mozilla-beta/rev/6e4639dc3614). 91 Branch: Patch [1](https://hg.mozilla.org/releases/mozilla-esr91/rev/72bca7a337e4) and [2](https://hg.mozilla.org/releases/mozilla-esr91/rev/befef01949f2) (Despite saying Parts 2 and 3, there is no Part 1)

CVE-2022-2200: Undesired attributes could be set as part of prototype pollution (moderate)
If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution.
CVE-2022-34468: CSP sandbox header without "allow-scripts" can be bypassed via retargeted javascript: URI (high)
An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link.
CVE-2022-34469: TLS certificate errors on HSTS-protected domains could be bypassed by the user on Firefox for Android (moderate)
When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to bypass the certificate error. On Firefox for Android, the user was presented with the option to bypass the error; this could only have been done by the user explicitly.
This bug only affects Firefox for Android. Other operating systems are unaffected.
CVE-2022-34470: Use-after-free in nsSHistory (high)
Session history navigations may have led to a use-after-free and potentially exploitable crash.
CVE-2022-34471: Compromised server could trick a browser into an addon downgrade (moderate)
When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version.
CVE-2022-34472: Unavailable PAC file resulted in OCSP requests being blocked (moderate)
If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown.
CVE-2022-34473: HTML Sanitizer could have been bypassed via use tags (low)
The HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code><use></code> tags; however it incorrectly did not sanitize <code>xlink:href</code> attributes.
CVE-2022-34474: Sandboxed iframes could redirect to external schemes (moderate)
Even when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if it received a redirect header to an external protocol the browser would process the redirect and prompt the user as appropriate.
CVE-2022-34475: HTML Sanitizer could have been bypassed via same-origin script via use tags (low)
SVG <code><use></code> tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML Sanitizer API. This would have required the attacker to reference a same-origin JavaScript file containing the script to be executed.
CVE-2022-34476: ASN.1 parser could have been tricked into accepting malformed ASN.1 (moderate)
ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1.
CVE-2022-34477: MediaError message property leaked information on cross-origin same-site pages (low)
The MediaError message property should be consistent to avoid leaking information about cross-origin resources; however for a same-site cross-origin resource, the message could have leaked information enabling XS-Leaks attacks.
CVE-2022-34478: Microsoft protocols can be attacked if a user accepts a prompt (moderate)
The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applications, bypassing the browser, when a user accepts a prompt. These applications have had known vulnerabilities, exploited in the wild (although we know of none exploited through Firefox), so in this release Firefox has blocked these protocols from prompting the user to open them.
This bug only affects Firefox on Windows. Other operating systems are unaffected.
CVE-2022-34479: A popup window could be resized in a way to overlay the address bar with web content (high)
A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks.

This bug only affects Firefox for Linux. Other operating systems are unaffected.
CVE-2022-34480: Free of uninitialized pointer in lg_init (low)
Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer would have been freed despite never being allocated.
CVE-2022-34481: Potential integer overflow in ReplaceElementsAt (moderate)
In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the number of elements to replace was too large for the container.
CVE-2022-34482: Drag and drop of malicious image could have led to malicious executable and potential code execution (moderate)
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34483.
CVE-2022-34483: Drag and drop of malicious image could have led to malicious executable and potential code execution (moderate)
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34482.
CVE-2022-34484: Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11 (high)
The Mozilla Fuzzing Team reported potential vulnerabilities present in Firefox 101 and Firefox ESR 91.10. Some of these bugs showed evidence of JavaScript prototype or memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
CVE-2022-34485: Memory safety bugs fixed in Firefox 102 (moderate)
Mozilla developers Bryce Seager van Dyk and the Mozilla Fuzzing Team reported potential vulnerabilities present in Firefox 101. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Package	Affected Version
pkg:mozilla/Firefox	< 102

Package	Fixed Version
pkg:mozilla/Firefox	= 102

ID

MFSA-2022-24

Severity

high

URL

https://www.mozilla.org/en-US/security/advisories/mfsa2022-24

Published

2022-06-28T00:00:00
(2 years ago)

Modified

2022-06-28T00:00:00
(2 years ago)

Other Advisories

Source	# ID	Name	URL
Bugzilla	1771381		https://bugzilla.mozilla.org/show_bug.cgi?id=1771381
Bugzilla	1768537		https://bugzilla.mozilla.org/show_bug.cgi?id=1768537
Bugzilla	1721220		https://bugzilla.mozilla.org/show_bug.cgi?id=1721220
Bugzilla	1765951		https://bugzilla.mozilla.org/show_bug.cgi?id=1765951
Bugzilla	1766047		https://bugzilla.mozilla.org/show_bug.cgi?id=1766047
Bugzilla	1770123		https://bugzilla.mozilla.org/show_bug.cgi?id=1770123
Bugzilla	1770888		https://bugzilla.mozilla.org/show_bug.cgi?id=1770888
Bugzilla	1677138		https://bugzilla.mozilla.org/show_bug.cgi?id=1677138
Bugzilla	1757210		https://bugzilla.mozilla.org/show_bug.cgi?id=1757210
Bugzilla	1387919		https://bugzilla.mozilla.org/show_bug.cgi?id=1387919
Bugzilla	1731614		https://bugzilla.mozilla.org/show_bug.cgi?id=1731614
Bugzilla	1773717		https://bugzilla.mozilla.org/show_bug.cgi?id=1773717
Bugzilla	1745595		https://bugzilla.mozilla.org/show_bug.cgi?id=1745595
Bugzilla	1454072		https://bugzilla.mozilla.org/show_bug.cgi?id=1454072
Bugzilla	1497246		https://bugzilla.mozilla.org/show_bug.cgi?id=1497246
Bugzilla	1483699		https://bugzilla.mozilla.org/show_bug.cgi?id=1483699
Bugzilla	845880		https://bugzilla.mozilla.org/show_bug.cgi?id=845880
Bugzilla	1335845		https://bugzilla.mozilla.org/show_bug.cgi?id=1335845
Bugzilla	1763634	Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11	https://bugzilla.mozilla.org/show_bug.cgi?id=1763634
Bugzilla	1772651	Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11	https://bugzilla.mozilla.org/show_bug.cgi?id=1772651
Bugzilla	1768409	Memory safety bugs fixed in Firefox 102	https://bugzilla.mozilla.org/show_bug.cgi?id=1768409
Bugzilla	1768578	Memory safety bugs fixed in Firefox 102	https://bugzilla.mozilla.org/show_bug.cgi?id=1768578

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:mozilla/Firefox		Firefox	< 102
Fixed	pkg:mozilla/Firefox		Firefox	= 102

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date