deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-4126
Published: 2022-12-22
Description: When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validity. This gave the false impression that the additional contents were also covered by the digital signature. Starting with Thunderbird version 91.4.1, only the signature that belongs to the top level MIME part will be considered for the displayed status. This vulnerability affects Thunderbird < 91.4.1.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1732310; https://www.mozilla.org/security/advisories/mfsa2021-55/; https://bugzilla.mozilla.org/show_bug.cgi?id=1732310
CVE: CVE-2021-4127
Published: 2022-12-22
Description: An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thunderbird < 78.9 and Firefox ESR < 78.9.
CVSS Score: 9.8 (CRITICAL)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1691547; https://www.mozilla.org/security/advisories/mfsa2021-11/; https://www.mozilla.org/security/advisories/mfsa2021-12/
CVE: CVE-2021-4128
Published: 2022-12-22
Description: When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory corruption and a potentially exploitable crash.<br>*This bug only affects Firefox on MacOS. Other operating systems are unaffected.*. This vulnerability affects Firefox < 95.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1735852; https://www.mozilla.org/security/advisories/mfsa2021-52/; https://bugzilla.mozilla.org/show_bug.cgi?id=1735852
CVE: CVE-2021-4129
Published: 2022-12-22
Description: Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in Firefox 94. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 95, Firefox ESR < 91.4.0, and Thunderbird < 91.4.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1393362%2C1736046%2C1736751%2C1737009%2C1739372%2C1739421; https://www.mozilla.org/security/advisories/mfsa2021-52/; https://www.mozilla.org/security/advisories/mfsa2021-53/
CVE: CVE-2021-4140
Published: 2022-12-22
Description: It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-91, CWE-91
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1746720; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://www.mozilla.org/security/advisories/mfsa2022-02/
CVE: CVE-2021-4221
Published: 2022-12-22
Description: If a domain name contained a RTL character, it would cause the domain to be rendered to the right of the path. This could lead to user confusion and spoofing attacks. <br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*<br>*Note*: Due to a clerical error this advisory was not included in the original announcement, and was added in Feburary 2022. This vulnerability affects Firefox < 92.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1007
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1704422; https://www.mozilla.org/security/advisories/mfsa2021-38/; https://bugzilla.mozilla.org/show_bug.cgi?id=1704422
CVE: CVE-2022-0511
Published: 2022-12-22
Description: Mozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan Herrera, Lars T Hansen, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 97.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1713579%2C1735448%2C1743821%2C1746313%2C1746314%2C1746316%2C1746321%2C1746322%2C1746323%2C1746412%2C1746430%2C1746451%2C1746488%2C1746875%2C1746898%2C1746905%2C1746907%2C1746917%2C1747128%2C1747137%2C1747331%2C1747346%2C1747439%2C1747457%2C1747870%2C1749051%2C1749274%2C1749831; https://www.mozilla.org/security/advisories/mfsa2022-04/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1713579%2C1735448%2C1743821%2C1746313%2C1746314%2C1746316%2C1746321%2C1746322%2C1746323%2C1746412%2C1746430%2C1746451%2C1746488%2C1746875%2C1746898%2C1746905%2C1746907%2C1746917%2C1747128%2C1747137%2C1747331%2C1747346%2C1747439%2C1747457%2C1747870%2C1749051%2C1749274%2C1749831
CVE: CVE-2022-0517
Published: 2022-12-22
Description: Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage this to launch arbitrary code with SYSTEM privilege. This vulnerability affects Mozilla VPN < 2.7.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1752291; https://www.mozilla.org/security/advisories/mfsa2022-08/; https://bugzilla.mozilla.org/show_bug.cgi?id=1752291
CVE: CVE-2022-0566
Published: 2022-12-22
Description: It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1753094; https://www.mozilla.org/security/advisories/mfsa2022-07/; https://bugzilla.mozilla.org/show_bug.cgi?id=1753094
CVE: CVE-2022-0843
Published: 2022-12-22
Description: Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 97. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 98.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1746523%2C1749062%2C1749164%2C1749214%2C1749610%2C1750032%2C1752100%2C1752405%2C1753612%2C1754508; https://www.mozilla.org/security/advisories/mfsa2022-10/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1746523%2C1749062%2C1749164%2C1749214%2C1749610%2C1750032%2C1752100%2C1752405%2C1753612%2C1754508
CVE: CVE-2022-1097
Published: 2022-12-22
Description: <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1745667; https://www.mozilla.org/security/advisories/mfsa2022-13/; https://www.mozilla.org/security/advisories/mfsa2022-14/
CVE: CVE-2022-1196
Published: 2022-12-22
Description: After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8 and Firefox ESR < 91.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1750679; https://www.mozilla.org/security/advisories/mfsa2022-14/; https://www.mozilla.org/security/advisories/mfsa2022-15/
CVE: CVE-2022-1197
Published: 2022-12-22
Description: When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird < 91.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1754985; https://www.mozilla.org/security/advisories/mfsa2022-15/; https://bugzilla.mozilla.org/show_bug.cgi?id=1754985
CVE: CVE-2022-1520
Published: 2022-12-22
Description: When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird < 91.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-346
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1745019; https://www.mozilla.org/security/advisories/mfsa2022-18/; https://bugzilla.mozilla.org/show_bug.cgi?id=1745019
CVE: CVE-2022-1529
Published: 2022-12-22
Description: An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1321, CWE-1321
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1770048; https://www.mozilla.org/security/advisories/mfsa2022-19/; https://bugzilla.mozilla.org/show_bug.cgi?id=1770048
CVE: CVE-2022-1802
Published: 2022-12-22
Description: If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1321, CWE-1321
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1770137; https://www.mozilla.org/security/advisories/mfsa2022-19/; https://bugzilla.mozilla.org/show_bug.cgi?id=1770137
CVE: CVE-2022-1834
Published: 2022-12-22
Description: When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed by many Braille space characters, the attacker's email address was not visible. Because Thunderbird compared the invisible sender address with the signature's email address, if the signing key or certificate was accepted by Thunderbird, the email was shown as having a valid digital signature. This vulnerability affects Thunderbird < 91.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1767816; https://www.mozilla.org/security/advisories/mfsa2022-22/; https://bugzilla.mozilla.org/show_bug.cgi?id=1767816
CVE: CVE-2022-1887
Published: 2022-12-22
Description: The search term could have been specified externally to trigger SQL injection. This vulnerability affects Firefox for iOS < 101.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1767205; https://www.mozilla.org/security/advisories/mfsa2022-23/; https://bugzilla.mozilla.org/show_bug.cgi?id=1767205
CVE: CVE-2022-22461
Published: 2022-12-22
Description: 
IBM Security Verify Governance, Identity Manager 10.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 225007.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/225077; https://www.ibm.com/support/pages/node/6850845; https://exchange.xforce.ibmcloud.com/vulnerabilities/225077
CVE: CVE-2022-22736
Published: 2022-12-22
Description: If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory for system libraries. However the install directory is not world-writable by default.<br>*This bug only affects Firefox for Windows in a non-default installation. Other operating systems are unaffected.*. This vulnerability affects Firefox < 96.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427, CWE-427
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1742692; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://bugzilla.mozilla.org/show_bug.cgi?id=1742692
CVE: CVE-2022-22737
Published: 2022-12-22
Description: Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362, CWE-362
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1745874; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://www.mozilla.org/security/advisories/mfsa2022-02/
CVE: CVE-2022-22738
Published: 2022-12-22
Description: Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1742382; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://www.mozilla.org/security/advisories/mfsa2022-02/
CVE: CVE-2022-22739
Published: 2022-12-22
Description: Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1744158; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://www.mozilla.org/security/advisories/mfsa2022-02/
CVE: CVE-2022-22740
Published: 2022-12-22
Description: Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1742334; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://www.mozilla.org/security/advisories/mfsa2022-02/
CVE: CVE-2022-22741
Published: 2022-12-22
Description: When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS Score: 7.5 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1740389; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://www.mozilla.org/security/advisories/mfsa2022-02/
CVE: CVE-2022-22742
Published: 2022-12-22
Description: When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1739923; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://www.mozilla.org/security/advisories/mfsa2022-02/
CVE: CVE-2022-22743
Published: 2022-12-22
Description: When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1739220; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://www.mozilla.org/security/advisories/mfsa2022-02/
CVE: CVE-2022-22744
Published: 2022-12-22
Description: The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if pasted into a Powershell prompt.<br>*This bug only affects Thunderbird for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-116, CWE-116
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1737252; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://www.mozilla.org/security/advisories/mfsa2022-02/
CVE: CVE-2022-22745
Published: 2022-12-22
Description: Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1735856; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://www.mozilla.org/security/advisories/mfsa2022-02/
CVE: CVE-2022-22746
Published: 2022-12-22
Description: A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.<br>*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1735071; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://www.mozilla.org/security/advisories/mfsa2022-02/
CVE: CVE-2022-22747
Published: 2022-12-22
Description: After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1735028; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://www.mozilla.org/security/advisories/mfsa2022-02/
CVE: CVE-2022-22748
Published: 2022-12-22
Description: Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1705211; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://www.mozilla.org/security/advisories/mfsa2022-02/
CVE: CVE-2022-22749
Published: 2022-12-22
Description: When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content.<br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 96.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1705094; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://bugzilla.mozilla.org/show_bug.cgi?id=1705094
CVE: CVE-2022-22750
Published: 2022-12-22
Description: By generally accepting and passing resource handles across processes, a compromised content process might have confused higher privileged processes to interact with handles that the unprivileged process should not have access to.<br>*This bug only affects Firefox for Windows and MacOS. Other operating systems are unaffected.*. This vulnerability affects Firefox < 96.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1566608; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://bugzilla.mozilla.org/show_bug.cgi?id=1566608
CVE: CVE-2022-22751
Published: 2022-12-22
Description: Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR 91.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1664149%2C1737816%2C1739366%2C1740274%2C1740797%2C1741201%2C1741869%2C1743221%2C1743515%2C1745373%2C1746011; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://www.mozilla.org/security/advisories/mfsa2022-02/
CVE: CVE-2022-22752
Published: 2022-12-22
Description: Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 96.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1741210%2C1742770; https://www.mozilla.org/security/advisories/mfsa2022-01/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1741210%2C1742770
CVE: CVE-2022-22753
Published: 2022-12-22
Description: A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-367, CWE-367
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1732435; https://www.mozilla.org/security/advisories/mfsa2022-04/; https://www.mozilla.org/security/advisories/mfsa2022-05/
CVE: CVE-2022-22754
Published: 2022-12-22
Description: If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new version the new requested permissions. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1750565; https://www.mozilla.org/security/advisories/mfsa2022-04/; https://www.mozilla.org/security/advisories/mfsa2022-05/
CVE: CVE-2022-22755
Published: 2022-12-22
Description: By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute JavaScript (within the bounds of the same-origin policy) even after the tab was closed. This vulnerability affects Firefox < 97.
CVSS Score: 8.8 (HIGH)
CWE: CWE-672, CWE-672
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1309630; https://www.mozilla.org/security/advisories/mfsa2022-04/; https://bugzilla.mozilla.org/show_bug.cgi?id=1309630
CVE: CVE-2022-22756
Published: 2022-12-22
Description: If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1317873; https://www.mozilla.org/security/advisories/mfsa2022-04/; https://www.mozilla.org/security/advisories/mfsa2022-05/