CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-31744 – Mozilla: CSP bypass enabling stylesheet injection
https://notcve.org/view.php?id=CVE-2022-31744
An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy. This vulnerability affects Firefox ESR < 91.11, Thunderbird < 102, Thunderbird < 91.11, and Firefox < 101. Un atacante podría haber inyectado CSS en hojas de estilo accesibles a través de URI internos, como recurso:, y al hacerlo eludir la Política de seguridad de contenido de una página. Esta vulnerabilidad afecta a Firefox ESR < 91.11, Thunderbird < 102, Thunderbird< 91.11 y Firefox < 101. A flaw was found in Mozilla. • https://bugzilla.mozilla.org/show_bug.cgi?id=1757604 https://www.mozilla.org/security/advisories/mfsa2022-20 https://www.mozilla.org/security/advisories/mfsa2022-25 https://www.mozilla.org/security/advisories/mfsa2022-26 https://access.redhat.com/security/cve/CVE-2022-31744 https://bugzilla.redhat.com/show_bug.cgi?id=2102165 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-1834 – Mozilla: Braille space character caused incorrect sender email to be shown for a digitally signed email
https://notcve.org/view.php?id=CVE-2022-1834
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed by many Braille space characters, the attacker's email address was not visible. Because Thunderbird compared the invisible sender address with the signature's email address, if the signing key or certificate was accepted by Thunderbird, the email was shown as having a valid digital signature. This vulnerability affects Thunderbird < 91.10. • https://bugzilla.mozilla.org/show_bug.cgi?id=1767816 https://www.mozilla.org/security/advisories/mfsa2022-22 https://access.redhat.com/security/cve/CVE-2022-1834 https://bugzilla.redhat.com/show_bug.cgi?id=2092416 • CWE-295: Improper Certificate Validation CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-31747 – Mozilla: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
https://notcve.org/view.php?id=CVE-2022-31747
Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. Los desarrolladores de Mozilla, Andrew McCreight, Nicolas B. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1760765%2C1765610%2C1766283%2C1767365%2C1768559%2C1768734 https://www.mozilla.org/security/advisories/mfsa2022-20 https://www.mozilla.org/security/advisories/mfsa2022-21 https://www.mozilla.org/security/advisories/mfsa2022-22 https://access.redhat.com/security/cve/CVE-2022-31747 https://bugzilla.redhat.com/show_bug.cgi?id=2092026 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-125: Out-of-bounds Read CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-31740 – Mozilla: Register allocation problem in WASM on arm64
https://notcve.org/view.php?id=CVE-2022-31740
On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. En arm64, el código WASM podría haber dado lugar a una generación de ensamblaje incorrecta, lo que provocó un problema de asignación de registros y un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Thunderbird < 91.10, Firefox < 101 y Firefox ESR < 91.10. The Mozilla Foundation Security Advisory describes this flaw as: On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash. • https://bugzilla.mozilla.org/show_bug.cgi?id=1766806 https://www.mozilla.org/security/advisories/mfsa2022-20 https://www.mozilla.org/security/advisories/mfsa2022-21 https://www.mozilla.org/security/advisories/mfsa2022-22 https://access.redhat.com/security/cve/CVE-2022-31740 https://bugzilla.redhat.com/show_bug.cgi?id=2092023 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-31741 – Mozilla: Uninitialized variable leads to invalid memory read
https://notcve.org/view.php?id=CVE-2022-31741
A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. Un mensaje CMS manipulado podría haberse procesado incorrectamente, lo que habría provocado una lectura de memoria no válida y, potencialmente, una mayor corrupción de la memoria. Esta vulnerabilidad afecta a Thunderbird < 91.10, Firefox < 101 y Firefox ESR < 91.10. The Mozilla Foundation Security Advisory describes this flaw as: A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. • https://bugzilla.mozilla.org/show_bug.cgi?id=1767590 https://www.mozilla.org/security/advisories/mfsa2022-20 https://www.mozilla.org/security/advisories/mfsa2022-21 https://www.mozilla.org/security/advisories/mfsa2022-22 https://access.redhat.com/security/cve/CVE-2022-31741 https://bugzilla.redhat.com/show_bug.cgi?id=2092024 • CWE-457: Use of Uninitialized Variable CWE-908: Use of Uninitialized Resource •