CVE-2022-46877
published 2022-12-22CVE-2022-46877: By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This…
PriorityP417medium4.3CVSS 3.1
AVNACLPRNUIRSUCNILAN
EPSS
0.70%
48.6th percentile
By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | firefox | < firefox 108.0-1 (sid) | firefox 108.0-1 (sid) |
| debian | firefox-esr | < firefox 108.0-1 (sid) | firefox 108.0-1 (sid) |
| debian | thunderbird | < firefox 108.0-1 (sid) | firefox 108.0-1 (sid) |
| mozilla | firefox | < 108.0 | 108.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 108.0.1+build1-0ubuntu0.18.04.1 | 108.0.1+build1-0ubuntu0.18.04.1 |
| mozilla | firefox | >= 0 < 108.0+build2-0ubuntu0.18.04.1 | 108.0+build2-0ubuntu0.18.04.1 |
| mozilla | firefox | >= 0 < 108.0.1+build1-0ubuntu0.20.04.1 | 108.0.1+build1-0ubuntu0.20.04.1 |
| mozilla | firefox | >= 0 < 108.0+build2-0ubuntu0.20.04.1 | 108.0+build2-0ubuntu0.20.04.1 |
| mozilla | firefox | >= unspecified < 108 | 108 |
| mozilla | thunderbird | >= 0 < 1:102.8.0-1~deb11u1 | 1:102.8.0-1~deb11u1 |
| mozilla | thunderbird | >= 0 < 1:102.7.1-1 | 1:102.7.1-1 |
| mozilla | thunderbird | >= 0 < 1:102.7.1-1 | 1:102.7.1-1 |
| mozilla | thunderbird | >= 0 < 1:102.7.1-1 | 1:102.7.1-1 |
| mozilla | thunderbird | >= 0 < 1:102.7.1+build2-0ubuntu0.18.04.1 | 1:102.7.1+build2-0ubuntu0.18.04.1 |
| mozilla | thunderbird | >= 0 < 1:102.7.1+build2-0ubuntu0.20.04.1 | 1:102.7.1+build2-0ubuntu0.20.04.1 |
| mozilla | thunderbird | >= 0 < 1:102.7.1+build2-0ubuntu0.22.04.1 | 1:102.7.1+build2-0ubuntu0.22.04.1 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
thunderbird vulnerabilities
osv·2023-02-06·CVSS 6.5
CVE-2022-45403 [MEDIUM] thunderbird vulnerabilities
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2022-45403, CVE-2022-45404,
CVE-2022-45405, CVE-2022-45406, CVE-2022-45408, CVE-2022-45409,
CVE-2022-45410, CVE-2022-45411, CVE-2022-45418, CVE-2022-45420,
CVE-2022-45421, CVE-2022-46878, CVE-2022-46880, CVE-2022-46881,
CVE-2022-46882, CVE-2023-23605)
Armin Ebert discovered that Thunderbird did not properly manage memory
while resolving file symlink. If a user were tricked into opening a
specially crafted weblink, an attacker could pote
OSV
firefox regressions
osv·2023-01-05·CVSS 8.8
CVE-2022-46871 [HIGH] firefox regressions
firefox regressions
USN-5782-1 fixed vulnerabilities in Firefox. The update introduced
several minor regressions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Firefox was using an out-of-date libusrsctp library.
An attacker could possibly use this library to perform a reentrancy issue
on Firefox. (CVE-2022-46871)
Nika Layzell discovered that Firefox was not performing a check on paste
received from cross-processes. An attacker could potentially exploit this
to obtain sensitive information. (CVE-2022-46872)
Pete Freitag discovered that Firefox did not implement the unsafe-hashes
CSP directive. An attacker who was able to inject markup into a page
otherwise protected by a Content Security Policy may have been able
OSV
CVE-2022-46877: By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks
osv·2022-12-22·CVSS 4.3
CVE-2022-46877 [MEDIUM] CVE-2022-46877: By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks
By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108.
GHSA
GHSA-qhr9-wjgv-2r72: By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks
ghsa_unreviewed·2022-12-22
CVE-2022-46877 [MEDIUM] CWE-79 GHSA-qhr9-wjgv-2r72: By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks
By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108.
OSV
firefox vulnerabilities
osv·2022-12-15·CVSS 8.8
CVE-2022-46871 [HIGH] firefox vulnerabilities
firefox vulnerabilities
It was discovered that Firefox was using an out-of-date libusrsctp library.
An attacker could possibly use this library to perform a reentrancy issue
on Firefox. (CVE-2022-46871)
Nika Layzell discovered that Firefox was not performing a check on paste
received from cross-processes. An attacker could potentially exploit this
to obtain sensitive information. (CVE-2022-46872)
Pete Freitag discovered that Firefox did not implement the unsafe-hashes
CSP directive. An attacker who was able to inject markup into a page
otherwise protected by a Content Security Policy may have been able to
inject an executable script. (CVE-2022-46873)
Matthias Zoellner discovered that Firefox was not keeping the filename
ending intact when using the drag-and-drop event. An attacker coul
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2023-02-06·CVSS 6.5
CVE-2022-45409 [MEDIUM] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2022-45403, CVE-2022-45404,
CVE-2022-45405, CVE-2022-45406, CVE-2022-45408, CVE-2022-45409,
CVE-2022-45410, CVE-2022-45411, CVE-2022-45418, CVE-2022-45420,
CVE-2022-45421, CVE-2022-46878, CVE-2022-46880, CVE-2022-46881,
CVE-2022-46882, CVE-2023-23605)
Armin Ebert discovered that Thunderbird did not properly manage memory
while resolving file symlink. If a user were tric
Red Hat
Mozilla: Fullscreen notification bypass
vendor_redhat·2023-01-17·CVSS 4.3
CVE-2022-46877 [MEDIUM] CWE-357 Mozilla: Fullscreen notification bypass
Mozilla: Fullscreen notification bypass
By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108.
The Mozilla Foundation Security Advisory describes this flaw as:
By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Package: firefox (Red Hat Enterprise Linux 6) - Out of support scope
Package: thunderbird (Red Hat Enterprise Linux 6) - Out of support scope
Ubuntu
Firefox regressions
vendor_ubuntu·2023-01-10·CVSS 8.8
CVE-2022-46871 [HIGH] Firefox regressions
Title: Firefox regressions
Summary: USN-5782-1 caused some minor regressions in Firefox.
USN-5782-1 fixed vulnerabilities in Firefox. The update introduced
several minor regressions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Firefox was using an out-of-date libusrsctp library.
An attacker could possibly use this library to perform a reentrancy issue
on Firefox. (CVE-2022-46871)
Nika Layzell discovered that Firefox was not performing a check on paste
received from cross-processes. An attacker could potentially exploit this
to obtain sensitive information. (CVE-2022-46872)
Pete Freitag discovered that Firefox did not implement the unsafe-hashes
CSP directive. An attacker who was able to inject markup into a pag
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2022-12-15·CVSS 8.8
CVE-2022-46878 [HIGH] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Several security issues were fixed in Firefox.
It was discovered that Firefox was using an out-of-date libusrsctp library.
An attacker could possibly use this library to perform a reentrancy issue
on Firefox. (CVE-2022-46871)
Nika Layzell discovered that Firefox was not performing a check on paste
received from cross-processes. An attacker could potentially exploit this
to obtain sensitive information. (CVE-2022-46872)
Pete Freitag discovered that Firefox did not implement the unsafe-hashes
CSP directive. An attacker who was able to inject markup into a page
otherwise protected by a Content Security Policy may have been able to
inject an executable script. (CVE-2022-46873)
Matthias Zoellner discovered that Firefox was not keeping the filename
en
Debian
CVE-2022-46877: firefox - By confusing the browser, the fullscreen notification could have been delayed or...
vendor_debian·2022·CVSS 4.3
CVE-2022-46877 [MEDIUM] CVE-2022-46877: firefox - By confusing the browser, the fullscreen notification could have been delayed or...
By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108.
Scope: local
sid: resolved (fixed in 108.0-1)
Mozilla
Mozilla Foundation Security Advisory 2023-02: CVE-2022-46877
vendor_mozilla·CVSS 4.3
CVE-2022-46877 [MEDIUM] Mozilla Foundation Security Advisory 2023-02: CVE-2022-46877
Mozilla Foundation Security Advisory 2023-02
CVE: CVE-2022-46877
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 102.7
Mozilla
Mozilla Foundation Security Advisory 2022-51: CVE-2022-46877
vendor_mozilla·CVSS 4.3
CVE-2022-46877 [MEDIUM] Mozilla Foundation Security Advisory 2022-51: CVE-2022-46877
Mozilla Foundation Security Advisory 2022-51
CVE: CVE-2022-46877
Product: Firefox
Impact: high
Fixed in: Firefox 108
Mozilla
Mozilla Foundation Security Advisory 2023-03: CVE-2022-46877
vendor_mozilla·CVSS 4.3
CVE-2022-46877 [MEDIUM] Mozilla Foundation Security Advisory 2023-03: CVE-2022-46877
Mozilla Foundation Security Advisory 2023-03
CVE: CVE-2022-46877
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 102.7
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1795139https://lists.debian.org/debian-lts-announce/2023/01/msg00015.htmlhttps://lists.debian.org/debian-lts-announce/2023/02/msg00018.htmlhttps://security.gentoo.org/glsa/202305-06https://security.gentoo.org/glsa/202305-13https://www.debian.org/security/2023/dsa-5322https://www.debian.org/security/2023/dsa-5355https://www.mozilla.org/security/advisories/mfsa2022-51/https://bugzilla.mozilla.org/show_bug.cgi?id=1795139https://lists.debian.org/debian-lts-announce/2023/01/msg00015.htmlhttps://lists.debian.org/debian-lts-announce/2023/02/msg00018.htmlhttps://security.gentoo.org/glsa/202305-06https://security.gentoo.org/glsa/202305-13https://www.debian.org/security/2023/dsa-5322https://www.debian.org/security/2023/dsa-5355https://www.mozilla.org/security/advisories/mfsa2022-51/
2022-12-22
Published