CVE-2022-26387
published 2022-12-22CVE-2022-26387: When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file…
PriorityP339high7.5CVSS 3.1
AVNACHPRNUIRSUCHIHAH
EPSS
0.66%
46.9th percentile
When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 98.0-1 (sid) | firefox 98.0-1 (sid) |
| debian | firefox-esr | < firefox 98.0-1 (sid) | firefox 98.0-1 (sid) |
| debian | thunderbird | < firefox 98.0-1 (sid) | firefox 98.0-1 (sid) |
| mozilla | firefox | < 98.0 | 98.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 98.0.1+build2-0ubuntu0.18.04.1 | 98.0.1+build2-0ubuntu0.18.04.1 |
| mozilla | firefox | >= 0 < 98.0+build3-0ubuntu0.18.04.2 | 98.0+build3-0ubuntu0.18.04.2 |
| mozilla | firefox | >= 0 < 98.0.2+build1-0ubuntu0.18.04.1 | 98.0.2+build1-0ubuntu0.18.04.1 |
| mozilla | firefox | >= 0 < 98.0.1+build2-0ubuntu0.20.04.1 | 98.0.1+build2-0ubuntu0.20.04.1 |
| mozilla | firefox | >= 0 < 98.0+build3-0ubuntu0.20.04.2 | 98.0+build3-0ubuntu0.20.04.2 |
| mozilla | firefox | >= 0 < 98.0.2+build1-0ubuntu0.20.04.1 | 98.0.2+build1-0ubuntu0.20.04.1 |
| mozilla | firefox | >= unspecified < 98 | 98 |
| mozilla | firefox_esr | < 91.7 | 91.7 |
| mozilla | firefox_esr | >= unspecified < 91.7 | 91.7 |
| mozilla | thunderbird | < 91.7 | 91.7 |
| mozilla | thunderbird | >= 0 < 1:91.7.0-2~deb11u1 | 1:91.7.0-2~deb11u1 |
| mozilla | thunderbird | >= 0 < 1:91.7.0-1 | 1:91.7.0-1 |
| mozilla | thunderbird | >= 0 < 1:91.7.0-1 | 1:91.7.0-1 |
| mozilla | thunderbird | >= 0 < 1:91.7.0-1 | 1:91.7.0-1 |
| mozilla | thunderbird | >= 0 < 1:91.7.0+build2-0ubuntu0.18.04.1 | 1:91.7.0+build2-0ubuntu0.18.04.1 |
| mozilla | thunderbird | >= 0 < 1:91.7.0+build2-0ubuntu0.20.04.1 | 1:91.7.0+build2-0ubuntu0.20.04.1 |
| mozilla | thunderbird | >= unspecified < 91.7 | 91.7 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Firefox regressions
vendor_ubuntu·2022-03-24·CVSS 8.8
[HIGH] Firefox regressions
Title: Firefox regressions
Summary: USN-5321-1 introduced minor regressions in Firefox.
USN-5321-1 fixed vulnerabilities in Firefox. The update introduced
several minor regressions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, spoof the browser
UI, bypass security restrictions, obtain sensitive information, or execute
arbitrary code. (CVE-2022-0843, CVE-2022-26381, CVE-2022-26382,
CVE-2022-26383, CVE-2022-26384, CVE-2022-26385)
A TOCTOU bug was discovered when verifying addon signatures during
install. A local attacker could potentially exploit th
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2022-03-23·CVSS 8.8
CVE-2022-26386 [HIGH] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
bypass security restrictions, obtain sensitive information, cause
undefined behaviour, spoof the browser UI, or execute arbitrary code.
(CVE-2022-22759, CVE-2022-22760, CVE-2022-22761, CVE-2022-22763,
CVE-2022-22764, CVE-2022-26381, CVE-2022-26383, CVE-2022-26384)
It was discovered that extensions of a particular type could auto-update
themselves and bypass the prompt that requests permissions. If a user
were tricked into installing a specially crafted extension, an attacker
coul
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2022-03-17·CVSS 8.8
CVE-2022-26382 [HIGH] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
USN-5321-1 fixed vulnerabilities in Firefox. The update didn't include
arm64 because of a regression. This update provides the corresponding
update for arm64.
This update also removes Yandex and Mail.ru as optional search providers
in the drop-down search menu.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, spoof the browser
UI, bypass security restrictions, obtain sensitive information, or execute
arbitrary code. (CVE-2022-0843, CVE-2022-26381, CVE-2022-26382,
CVE-2022-26383, CVE-20
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2022-03-10·CVSS 8.8
CVE-2022-26384 [HIGH] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, spoof the browser
UI, bypass security restrictions, obtain sensitive information, or execute
arbitrary code. (CVE-2022-0843, CVE-2022-26381, CVE-2022-26382,
CVE-2022-26383, CVE-2022-26384, CVE-2022-26385)
A TOCTOU bug was discovered when verifying addon signatures during
install. A local attacker could potentially exploit this to trick a
user into installing an addon with an invalid signature.
(CVE-2022-26387)
Instructions: After a standard system update you need t
Red Hat
Mozilla: Time-of-check time-of-use bug when verifying add-on signatures
vendor_redhat·2022-03-08·CVSS 7.5
CVE-2022-26387 [HIGH] CWE-367 Mozilla: Time-of-check time-of-use bug when verifying add-on signatures
Mozilla: Time-of-check time-of-use bug when verifying add-on signatures
When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified, and Firefox would not have noticed.
Package: firefox (Red Hat Enterprise Linux 6) - Out of support scope
Package: thunderbird (Red Hat
Debian
CVE-2022-26387: firefox - When installing an add-on, Firefox verified the signature before prompting the u...
vendor_debian·2022·CVSS 7.5
CVE-2022-26387 [HIGH] CVE-2022-26387: firefox - When installing an add-on, Firefox verified the signature before prompting the u...
When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.
Scope: local
sid: resolved (fixed in 98.0-1)
Mozilla
Mozilla Foundation Security Advisory 2022-12: CVE-2022-26387
vendor_mozilla·CVSS 7.5
CVE-2022-26387 [HIGH] Mozilla Foundation Security Advisory 2022-12: CVE-2022-26387
Mozilla Foundation Security Advisory 2022-12
CVE: CVE-2022-26387
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 91.7
Mozilla
Mozilla Foundation Security Advisory 2022-11: CVE-2022-26387
vendor_mozilla·CVSS 7.5
CVE-2022-26387 [HIGH] Mozilla Foundation Security Advisory 2022-11: CVE-2022-26387
Mozilla Foundation Security Advisory 2022-11
CVE: CVE-2022-26387
Product: Firefox ESR
Impact: low
Fixed in: Firefox ESR 91.7
Mozilla
Mozilla Foundation Security Advisory 2022-10: CVE-2022-26387
vendor_mozilla·CVSS 7.5
CVE-2022-26387 [HIGH] Mozilla Foundation Security Advisory 2022-10: CVE-2022-26387
Mozilla Foundation Security Advisory 2022-10
CVE: CVE-2022-26387
Product: Firefox
Impact: moderate
Fixed in: Firefox 98
GHSA
GHSA-w44g-v7w6-xpcv: When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-
ghsa_unreviewed·2022-12-22
CVE-2022-26387 [HIGH] CWE-367 GHSA-w44g-v7w6-xpcv: When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-
When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.
OSV
CVE-2022-26387: When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-
osv·2022-12-22·CVSS 7.5
CVE-2022-26387 [HIGH] CVE-2022-26387: When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-
When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.
OSV
firefox regressions
osv·2022-03-24·CVSS 8.8
[HIGH] firefox regressions
firefox regressions
USN-5321-1 fixed vulnerabilities in Firefox. The update introduced
several minor regressions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, spoof the browser
UI, bypass security restrictions, obtain sensitive information, or execute
arbitrary code. (CVE-2022-0843, CVE-2022-26381, CVE-2022-26382,
CVE-2022-26383, CVE-2022-26384, CVE-2022-26385)
A TOCTOU bug was discovered when verifying addon signatures during
install. A local attacker could potentially exploit this to trick a
user into installing an addon with an invalid signature
OSV
thunderbird vulnerabilities
osv·2022-03-23·CVSS 8.8
CVE-2022-22759 [HIGH] thunderbird vulnerabilities
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
bypass security restrictions, obtain sensitive information, cause
undefined behaviour, spoof the browser UI, or execute arbitrary code.
(CVE-2022-22759, CVE-2022-22760, CVE-2022-22761, CVE-2022-22763,
CVE-2022-22764, CVE-2022-26381, CVE-2022-26383, CVE-2022-26384)
It was discovered that extensions of a particular type could auto-update
themselves and bypass the prompt that requests permissions. If a user
were tricked into installing a specially crafted extension, an attacker
could potentially exploit this to bypass security restrictions.
(CVE-202
OSV
firefox vulnerabilities
osv·2022-03-17·CVSS 8.8
[HIGH] firefox vulnerabilities
firefox vulnerabilities
USN-5321-1 fixed vulnerabilities in Firefox. The update didn't include
arm64 because of a regression. This update provides the corresponding
update for arm64.
This update also removes Yandex and Mail.ru as optional search providers
in the drop-down search menu.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, spoof the browser
UI, bypass security restrictions, obtain sensitive information, or execute
arbitrary code. (CVE-2022-0843, CVE-2022-26381, CVE-2022-26382,
CVE-2022-26383, CVE-2022-26384, CVE-2022-26385)
A TOCTOU bug was discovered when verifying addon signatures during
install. A local a
OSV
firefox vulnerabilities
osv·2022-03-10·CVSS 8.8
CVE-2022-0843 [HIGH] firefox vulnerabilities
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, spoof the browser
UI, bypass security restrictions, obtain sensitive information, or execute
arbitrary code. (CVE-2022-0843, CVE-2022-26381, CVE-2022-26382,
CVE-2022-26383, CVE-2022-26384, CVE-2022-26385)
A TOCTOU bug was discovered when verifying addon signatures during
install. A local attacker could potentially exploit this to trick a
user into installing an addon with an invalid signature.
(CVE-2022-26387)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1752979https://www.mozilla.org/security/advisories/mfsa2022-10/https://www.mozilla.org/security/advisories/mfsa2022-11/https://www.mozilla.org/security/advisories/mfsa2022-12/https://bugzilla.mozilla.org/show_bug.cgi?id=1752979https://www.mozilla.org/security/advisories/mfsa2022-10/https://www.mozilla.org/security/advisories/mfsa2022-11/https://www.mozilla.org/security/advisories/mfsa2022-12/
2022-12-22
Published