A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed. *This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed. *This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22746)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox
 96 and Firefox ESR 91.5. Some of these bugs showed evidence of memory corruption and we presume that with
 enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects
 Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (CVE-2022-22764)

 - It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This
 vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2021-4140)

 - Mozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan Herrera,
 Lars T Hansen, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96. Some of
 these bugs showed evidence of memory corruption and we presume that with enough effort some of these could
 have been exploited to run arbitrary code. This vulnerability affects Firefox < 97. (CVE-2022-0511)

 - If Firefox was installed to a world-writable directory, a local privilege escalation could occur when
 Firefox searched the current directory for system libraries. However the install directory is not world-
 writable by default. *This bug only affects Firefox for Windows in a non-default installation. Other
 operating systems are unaffected.*. This vulnerability affects Firefox < 96. (CVE-2022-22736)

 - Constructing audio sinks could have lead to a race condition when playing audio files and closing windows.
 This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability
 affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22737)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson
 Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR
 91.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some
 of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 91.5,
 Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22751)

 - It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This
 vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2021-4140)

 - Constructing audio sinks could have lead to a race condition when playing audio files and closing windows.
 This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability
 affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22737)

 - Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-
 buffer-overflow causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5,
 Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22738)

 - Malicious websites could have tricked users into accepting launching a program to handle an external URL
 protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
 (CVE-2022-22739)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0199-1 advisory.

  - Mozilla: Iframe sandbox bypass with XSLT (CVE-2021-4140)

  - Mozilla: Race condition when playing audio files (CVE-2022-22737)

  - Mozilla: Heap-buffer-overflow in blendGaussianBlur (CVE-2022-22738)

  - Mozilla: Missing throttling on external protocol launch dialog (CVE-2022-22739)

  - Mozilla: Use-after-free of ChannelEventQueue::mOwner (CVE-2022-22740)

  - Mozilla: Browser window spoof using fullscreen mode (CVE-2022-22741)

  - Mozilla: Out-of-bounds memory access when inserting text in edit mode (CVE-2022-22742)

  - When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could     have made the browser unable to leave fullscreen mode.  (CVE-2022-22743)

  - The constructed curl command from the Copy as curl feature in DevTools was not properly escaped for     PowerShell.  This could have lead to command injection if pasted into a Powershell prompt. This bug only     affects Firefox for Windows. Other operating systems are unaffected.  (CVE-2022-22744)

  - Mozilla: Leaking cross-origin URLs through securitypolicyviolation event (CVE-2022-22745)

  - A race condition could have allowed bypassing the fullscreen notification which could have lead to a     fullscreen window spoof being unnoticed. This bug only affects Thunderbird for Windows. Other operating     systems are unaffected.  (CVE-2022-22746)

  - Mozilla: Crash when handling empty pkcs7 sequence (CVE-2022-22747)

  - Mozilla: Spoofed origin on external protocol launch dialog (CVE-2022-22748)

  - Mozilla: Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5 (CVE-2022-22751)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0199-1 advisory.

    - CVE-2021-4140: Fixed Iframe sandbox bypass with XSLT (bsc#1194547).
    - CVE-2022-22737: Fixed race condition when playing audio files (bsc#1194547).
    - CVE-2022-22738: Fixed heap-buffer-overflow in blendGaussianBlur (bsc#1194547).
    - CVE-2022-22739: Fixed missing throttling on external protocol launch dialog (bsc#1194547).
    - CVE-2022-22740: Fixed use-after-free of ChannelEventQueue::mOwner (bsc#1194547).
    - CVE-2022-22741: Fixed browser window spoof using fullscreen mode (bsc#1194547).
    - CVE-2022-22742: Fixed out-of-bounds memory access when inserting text in edit mode (bsc#1194547).
    - CVE-2022-22743: Fixed browser window spoof using fullscreen mode (bsc#1194547).
    - CVE-2022-22744: Fixed possible command injection via the 'Copy as curl' feature in DevTools     (bsc#1194547).
    - CVE-2022-22745: Fixed leaking cross-origin URLs through securitypolicyviolation event (bsc#1194547).
    - CVE-2022-22746: Fixed calling into reportValidity could have lead to fullscreen window spoof     (bsc#1194547).
    - CVE-2022-22747: Fixed crash when handling empty pkcs7 sequence(bsc#1194547).
    - CVE-2022-22748: Fixed spoofed origin on external protocol launch dialog (bsc#1194547).
    - CVE-2022-22751: Fixed memory safety bugs (bsc#1194547).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:14880-1 advisory.

 - It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2021-4140)

 - Constructing audio sinks could have lead to a race condition when playing audio files and closing windows.
 This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22737)

 - Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap- buffer-overflow causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22738)

 - Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
 (CVE-2022-22739)

 - Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22740)

 - When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
 (CVE-2022-22741)

 - When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22742)

 - When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22743)

 - The constructed curl command from the Copy as curl feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if pasted into a Powershell prompt. *This bug only affects Thunderbird for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22744)

 - Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations.
 This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22745)

 - A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed. *This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22746)

 - After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22747)

 - Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22748)

 - Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR 91.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. (CVE-2022-22751)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0136-1 advisory.

  - Mozilla: Iframe sandbox bypass with XSLT (CVE-2021-4140)

  - Mozilla: Race condition when playing audio files (CVE-2022-22737)

  - Mozilla: Heap-buffer-overflow in blendGaussianBlur (CVE-2022-22738)

  - Mozilla: Missing throttling on external protocol launch dialog (CVE-2022-22739)

  - Mozilla: Use-after-free of ChannelEventQueue::mOwner (CVE-2022-22740)

  - Mozilla: Browser window spoof using fullscreen mode (CVE-2022-22741)

  - Mozilla: Out-of-bounds memory access when inserting text in edit mode (CVE-2022-22742)

  - When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could     have made the browser unable to leave fullscreen mode.  (CVE-2022-22743)

  - The constructed curl command from the Copy as curl feature in DevTools was not properly escaped for     PowerShell.  This could have lead to command injection if pasted into a Powershell prompt. This bug only     affects Firefox for Windows. Other operating systems are unaffected.  (CVE-2022-22744)

  - Mozilla: Leaking cross-origin URLs through securitypolicyviolation event (CVE-2022-22745)

  - A race condition could have allowed bypassing the fullscreen notification which could have lead to a     fullscreen window spoof being unnoticed. This bug only affects Thunderbird for Windows. Other operating     systems are unaffected.  (CVE-2022-22746)

  - Mozilla: Crash when handling empty pkcs7 sequence (CVE-2022-22747)

  - Mozilla: Spoofed origin on external protocol launch dialog (CVE-2022-22748)

  - Mozilla: Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5 (CVE-2022-22751)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0136-1 advisory.

    - CVE-2021-4140: Fixed iframe sandbox bypass with XSLT (bsc#1194547).
    - CVE-2022-22737: Fixed race condition when playing audio files (bsc#1194547).
    - CVE-2022-22738: Fixed heap-buffer-overflow in blendGaussianBlur (bsc#1194547).
    - CVE-2022-22739: Fixed missing throttling on external protocol launch dialog (bsc#1194547).
    - CVE-2022-22740: Fixed use-after-free of ChannelEventQueue::mOwner (bsc#1194547).
    - CVE-2022-22741: Fixed browser window spoof using fullscreen mode (bsc#1194547).
    - CVE-2022-22742: Fixed out-of-bounds memory access when inserting text in edit mode (bsc#1194547).
    - CVE-2022-22743: Fixed browser window spoof using fullscreen mode (bsc#1194547).
    - CVE-2022-22744: Fixed possible command injection via the 'Copy as curl' feature in DevTools     (bsc#1194547).
    - CVE-2022-22745: Fixed leaking cross-origin URLs through securitypolicyviolation event (bsc#1194547).
    - CVE-2022-22746: Fixed calling into reportValidity could have lead to fullscreen window spoof     (bsc#1194547).
    - CVE-2022-22747: Fixed crash when handling empty pkcs7 sequence(bsc#1194547).
    - CVE-2022-22748: Fixed spoofed origin on external protocol launch dialog (bsc#1194547).
    - CVE-2022-22751: Fixed memory safety bugs (bsc#1194547).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0137-1 advisory.

    - CVE-2021-4140: Fixed iframe sandbox bypass with XSLT (bsc#1194547).
    - CVE-2022-22737: Fixed race condition when playing audio files (bsc#1194547).
    - CVE-2022-22738: Fixed heap-buffer-overflow in blendGaussianBlur (bsc#1194547).
    - CVE-2022-22739: Fixed missing throttling on external protocol launch dialog (bsc#1194547).
    - CVE-2022-22740: Fixed use-after-free of ChannelEventQueue::mOwner (bsc#1194547).
    - CVE-2022-22741: Fixed browser window spoof using fullscreen mode (bsc#1194547).
    - CVE-2022-22742: Fixed out-of-bounds memory access when inserting text in edit mode (bsc#1194547).
    - CVE-2022-22743: Fixed browser window spoof using fullscreen mode (bsc#1194547).
    - CVE-2022-22744: Fixed possible command injection via the 'Copy as curl' feature in DevTools     (bsc#1194547).
    - CVE-2022-22745: Fixed leaking cross-origin URLs through securitypolicyviolation event (bsc#1194547).
    - CVE-2022-22746: Fixed calling into reportValidity could have lead to fullscreen window spoof     (bsc#1194547).
    - CVE-2022-22747: Fixed crash when handling empty pkcs7 sequence(bsc#1194547).
    - CVE-2022-22748: Fixed spoofed origin on external protocol launch dialog (bsc#1194547).
    - CVE-2022-22751: Fixed memory safety bugs (bsc#1194547).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0115-1 advisory.

    - CVE-2021-4140: Fixed iframe sandbox bypass with XSLT (bsc#1194547).
    - CVE-2022-22737: Fixed race condition when playing audio files (bsc#1194547).
    - CVE-2022-22738: Fixed heap-buffer-overflow in blendGaussianBlur (bsc#1194547).
    - CVE-2022-22739: Fixed missing throttling on external protocol launch dialog (bsc#1194547).
    - CVE-2022-22740: Fixed use-after-free of ChannelEventQueue::mOwner (bsc#1194547).
    - CVE-2022-22741: Fixed browser window spoof using fullscreen mode (bsc#1194547).
    - CVE-2022-22742: Fixed out-of-bounds memory access when inserting text in edit mode (bsc#1194547).
    - CVE-2022-22743: Fixed browser window spoof using fullscreen mode (bsc#1194547).
    - CVE-2022-22744: Fixed possible command injection via the 'Copy as curl' feature in DevTools     (bsc#1194547).
    - CVE-2022-22745: Fixed leaking cross-origin URLs through securitypolicyviolation event (bsc#1194547).
    - CVE-2022-22746: Fixed calling into reportValidity could have lead to fullscreen window spoof     (bsc#1194547).
    - CVE-2022-22747: Fixed crash when handling empty pkcs7 sequence(bsc#1194547).
    - CVE-2022-22748: Fixed spoofed origin on external protocol launch dialog (bsc#1194547).
    - CVE-2022-22751: Fixed memory safety bugs (bsc#1194547).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 91.5. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-03 advisory.

  - Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson     Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR     91.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. (CVE-2022-22751)

  - It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox.
    (CVE-2021-4140)

  - A race condition could have allowed bypassing the fullscreen notification which could have lead to a     fullscreen window spoof being unnoticed. This bug only affects Firefox for Windows. Other operating     systems are unaffected. (CVE-2022-22746)

  - When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could     have made the browser unable to leave fullscreen mode. (CVE-2022-22743)

  - When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access     causing a potentially exploitable crash. (CVE-2022-22742)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.5. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-03 advisory.

  - Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson     Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR     91.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. (CVE-2022-22751)

  - It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox.
    (CVE-2021-4140)

  - A race condition could have allowed bypassing the fullscreen notification which could have lead to a     fullscreen window spoof being unnoticed. This bug only affects Firefox for Windows. Other operating     systems are unaffected. (CVE-2022-22746)

  - When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could     have made the browser unable to leave fullscreen mode. (CVE-2022-22743)

  - When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access     causing a potentially exploitable crash. (CVE-2022-22742)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 96.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-01 advisory.

  - When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after     where it should not be possible. (CVE-2022-22763)

  - It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox.
    (CVE-2021-4140)

  - A race condition could have allowed bypassing the fullscreen notification which could have lead to a     fullscreen window spoof being unnoticed. This bug only affects Firefox for Windows. Other operating     systems are unaffected. (CVE-2022-22746)

  - When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could     have made the browser unable to leave fullscreen mode. (CVE-2022-22743)

  - When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access     causing a potentially exploitable crash. (CVE-2022-22742)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 96.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-01 advisory.

  - When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after     where it should not be possible. (CVE-2022-22763)

  - It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox.
    (CVE-2021-4140)

  - A race condition could have allowed bypassing the fullscreen notification which could have lead to a     fullscreen window spoof being unnoticed. This bug only affects Firefox for Windows. Other operating     systems are unaffected. (CVE-2022-22746)

  - When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could     have made the browser unable to leave fullscreen mode. (CVE-2022-22743)

  - When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access     causing a potentially exploitable crash. (CVE-2022-22742)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 91.5. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-02 advisory.

  - Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson     Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR     91.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. (CVE-2022-22751)

  - It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox.
    (CVE-2021-4140)

  - A race condition could have allowed bypassing the fullscreen notification which could have lead to a     fullscreen window spoof being unnoticed. This bug only affects Thunderbird for Windows. Other operating     systems are unaffected. (CVE-2022-22746)

  - When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could     have made the browser unable to leave fullscreen mode. (CVE-2022-22743)

  - When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access     causing a potentially exploitable crash. (CVE-2022-22742)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 91.5. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-02 advisory.

  - Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson     Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR     91.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. (CVE-2022-22751)

  - It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox.
    (CVE-2021-4140)

  - A race condition could have allowed bypassing the fullscreen notification which could have lead to a     fullscreen window spoof being unnoticed. This bug only affects Thunderbird for Windows. Other operating     systems are unaffected. (CVE-2022-22746)

  - When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could     have made the browser unable to leave fullscreen mode. (CVE-2022-22743)

  - When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access     causing a potentially exploitable crash. (CVE-2022-22742)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
244352	Linux Distros Unpatched Vulnerability : CVE-2022-22746	Nessus	Misc.	medium
426763	Alpine: multiple librewolf packages: security update to 97.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
426763	Alpine: multiple librewolf packages: security update to 97.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
426118	Alpine: thunderbird: security update to 91.5.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
426118	Alpine: thunderbird: security update to 91.5.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
404459	Alpine: multiple firefox-esr packages: security update to 91.5.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404459	Alpine: multiple firefox-esr packages: security update to 91.5.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
404388	Alpine: multiple firefox packages: security update to 97.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404388	Alpine: multiple firefox packages: security update to 97.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
157148	openSUSE 15 Security Update : MozillaThunderbird (openSUSE-SU-2022:0199-1)	Nessus	SuSE Local Security Checks	critical
157145	SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2022:0199-1)	Nessus	SuSE Local Security Checks	critical
157105	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2022:14880-1)	Nessus	SuSE Local Security Checks	critical
156943	openSUSE 15 Security Update : MozillaFirefox (openSUSE-SU-2022:0136-1)	Nessus	SuSE Local Security Checks	critical
156927	SUSE SLED15: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2022:0136-1)	Nessus	SuSE Local Security Checks	critical
156926	SUSE SLES15: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2022:0137-1)	Nessus	SuSE Local Security Checks	critical
156811	SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2022:0115-1)	Nessus	SuSE Local Security Checks	critical
156610	Mozilla Thunderbird < 91.5	Nessus	Windows	critical
156609	Mozilla Thunderbird < 91.5	Nessus	MacOS X Local Security Checks	critical
156606	Mozilla Firefox < 96.0	Nessus	Windows	critical
156605	Mozilla Firefox < 96.0	Nessus	MacOS X Local Security Checks	critical
156604	Mozilla Firefox ESR < 91.5	Nessus	MacOS X Local Security Checks	critical
156603	Mozilla Firefox ESR < 91.5	Nessus	Windows	critical

Detections

Analytics

CVE-2022-22746

medium

Tenable Plugins

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical