CVE-2022-22744

El comando curl creado de la función "Copiar como curl" en DevTools no se escapó correctamente para PowerShell. Esto podría haber dado lugar a la inyección de comandos si se hubiera pegado en un indicador de Powershell.<br>*Este error solo afecta a Thunderbird para Windows. Otros sistemas operativos no se ven afectados.*. Esta vulnerabilidad afecta a Firefox ESR &lt; 91.5, Firefox &lt; 96 y Thunderbird &lt; 91.5.

An update that fixes 14 vulnerabilities is now available. This update for MozillaThunderbird fixes the following issues. Fixed Iframe sandbox bypass with XSLT. Fixed race condition when playing audio files. Fixed heap-buffer-overflow in blendGaussianBlur. Fixed missing throttling on external protocol launch dialog. Fixed use-after-free of ChannelEventQueue::mOwner. Fixed browser window spoof using fullscreen mode. Fixed out-of-bounds memory access when inserting text in edit mode. Fixed browser window spoof using fullscreen mode. Fixed possible command injection via the 'Copy as curl' feature in DevTools. Fixed leaking cross-origin URLs through securitypolicyviolation event. Fixed calling into reportValidity could have lead to fullscreen window spoof. Fixed crash when handling empty pkcs7 sequence. Fixed spoofed origin on external protocol launch dialog. Fixed memory safety bugs.