Firefox 103 Security Advisory: Memory Safety Bugs and Multiple CVE Fixes

Vulnerability Key Information Summary Vulnerability Overview Announcement Date: July 26, 2022 Impact: Medium, Low Product: Firefox Fixed Version: Firefox 103 Vulnerability Details 1. CVE-2022-36319: Mouse Position spoofing with CSS transforms - Reporter: Irwan Kurniawan - Impact: Medium - Description: When combining CSS overflow and transform properties, the mouse cursor may not align with the displayed coordinates. - References: Bug 1737722 2. CVE-2022-36317: Long URL would hang Firefox for Android - Reporter: Irwan - Impact: Medium - Description: Accessing websites with excessively long URLs causes the UI to hang. Due to session restoration, this could lead to permanent denial of service. This vulnerability affects only Firefox for Android; other operating systems are unaffected. - References: Bug 1759951 3. CVE-2022-36318: Directory indexes for bundled resources reflected URL parameters - Reporter: Gijs Kruitbosch - Impact: Medium - Description: When accessing directory listings with chrome:// URLs as source text, some parameters are reflected. - References: Bug 1771774 4. CVE-2022-36314: Opening local ".lnk" files could cause unexpected network loads - Reporter: akucybersec - Impact: Medium - Description: When opening Windows shortcuts from the local filesystem, an attacker can provide a remote path, potentially causing the operating system to make unintended network requests. This vulnerability affects only Firefox on Windows; other operating systems are unaffected. - References: Bug 1773894 5. CVE-2022-36315: Preload Cache Bypasses Subresource Integrity - Reporter: Hiroshige Hayashizaki - Impact: Low - Description: When loading scripts with Subresource Integrity, an attacker with injection capabilities can trigger reuse of previously cached entries with incorrect, differing integrity metadata. - References: Bug 1762520 6. CVE-2022-36316: Performance API leaked whether a cross-site resource is redirecting - Reporter: Jannis Rautenstrauch - Impact: Low - Description: Using the Performance API, attackers can detect subtle differences between PerformanceEntries to determine whether a target URL is being redirected. - References: Bug 1768583 7. CVE-2022-36320: Memory safety bugs fixed in Firefox 103 - Reporter: Mozilla developers and community - Impact: High - Description: Mozilla developers and the Mozilla fuzzing team reported memory safety vulnerabilities present in Firefox 102. Some of these vulnerabilities show evidence of memory corruption, and we assume they could potentially be exploited to execute arbitrary code with sufficient effort. - References: Memory safety bugs fixed in Firefox 103 8. CVE-2022-2505: Memory safety bugs fixed in Firefox 103 and 102.1 - Reporter: Mozilla developers and community - Impact: High - Description: Mozilla developers and the Mozilla fuzzing team reported memory safety vulnerabilities present in Firefox 102. Some of these vulnerabilities show evidence of memory corruption, and we assume they could potentially be exploited to execute arbitrary code with sufficient effort. - References: Memory safety bugs fixed in Firefox 103 and 102.1

Goal Reached Thanks to every supporter — we hit 100%!

Firefox 103 Security Advisory: Memory Safety Bugs and Multiple CVE Fixes

More from this source