CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29913 – Mozilla: Speech Synthesis feature not properly disabled
https://notcve.org/view.php?id=CVE-2022-29913
The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions from a child process. This vulnerability affects Thunderbird < 91.9. El proceso principal no verificaba adecuadamente si la función Speech Synthesis está habilitada al recibir instrucciones de un proceso secundario. Esta vulnerabilidad afecta a Thunderbird < 91.9. A flaw was found in Mozilla. • https://bugzilla.mozilla.org/show_bug.cgi?id=1764778 https://www.mozilla.org/security/advisories/mfsa2022-18 https://access.redhat.com/security/cve/CVE-2022-29913 https://bugzilla.redhat.com/show_bug.cgi?id=2082038 • CWE-1173: Improper Use of Validation Framework •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 4CVE-2022-29916 – Mozilla: Leaking browser history with CSS variables
https://notcve.org/view.php?id=CVE-2022-29916
Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the browser history. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Firefox se comportó de manera ligeramente diferente para recursos ya conocidos al cargar recursos CSS que involucraban variables CSS. Esto podría haberse utilizado para sondear el historial del navegador. • https://bugzilla.mozilla.org/show_bug.cgi?id=1760674 https://www.mozilla.org/security/advisories/mfsa2022-16 https://www.mozilla.org/security/advisories/mfsa2022-17 https://www.mozilla.org/security/advisories/mfsa2022-18 https://access.redhat.com/security/cve/CVE-2022-29916 https://bugzilla.redhat.com/show_bug.cgi?id=2081470 • CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2022-29912 – Mozilla: Reader mode bypassed SameSite cookies
https://notcve.org/view.php?id=CVE-2022-29912
Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Las solicitudes iniciadas a través del modo lector no omitieron correctamente las cookies con un atributo SameSite. Esta vulnerabilidad afecta a Thunderbird < 91.9, Firefox ESR < 91.9 y Firefox < 100. A flaw was found in Mozilla. • https://bugzilla.mozilla.org/show_bug.cgi?id=1692655 https://www.mozilla.org/security/advisories/mfsa2022-16 https://www.mozilla.org/security/advisories/mfsa2022-17 https://www.mozilla.org/security/advisories/mfsa2022-18 https://access.redhat.com/security/cve/CVE-2022-29912 https://bugzilla.redhat.com/show_bug.cgi?id=2081472 • CWE-565: Reliance on Cookies without Validation and Integrity Checking CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 1CVE-2022-29917 – Mozilla: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
https://notcve.org/view.php?id=CVE-2022-29917
Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR 91.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Los desarrolladores de Mozilla, Andrew McCreight, Gabriele Svelto, Tom Ritter y el equipo Mozilla Fuzzing, informaron sobre errores de seguridad de la memoria presentes en Firefox 99 y Firefox ESR 91.8. Algunos de estos errores mostraron evidencia de corrupción de memoria y suponemos que con suficiente esfuerzo algunos de ellos podrían haberse aprovechado para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1684739%2C1706441%2C1753298%2C1762614%2C1762620%2C1764778 https://www.mozilla.org/security/advisories/mfsa2022-16 https://www.mozilla.org/security/advisories/mfsa2022-17 https://www.mozilla.org/security/advisories/mfsa2022-18 https://access.redhat.com/security/cve/CVE-2022-29917 https://bugzilla.redhat.com/show_bug.cgi?id=2081473 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-29911 – Mozilla: iframe Sandbox bypass
https://notcve.org/view.php?id=CVE-2022-29911
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Una implementación incorrecta de la nueva palabra clave de iframe sandbox <code>allow-top-navigation-by-user-activation</code> podría provocar la ejecución del script sin que <code>allow-scripts</code> esté presente. Esta vulnerabilidad afecta a Thunderbird < 91.9, Firefox ESR < 91.9 y Firefox < 100. A flaw was found in Mozilla. • https://bugzilla.mozilla.org/show_bug.cgi?id=1761981 https://www.mozilla.org/security/advisories/mfsa2022-16 https://www.mozilla.org/security/advisories/mfsa2022-17 https://www.mozilla.org/security/advisories/mfsa2022-18 https://access.redhat.com/security/cve/CVE-2022-29911 https://bugzilla.redhat.com/show_bug.cgi?id=2081471 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •