openSUSE 15 Security Update : MozillaFirefox (openSUSE-SU-2022:0136-1)

high Nessus Plugin ID 156943



The remote SUSE host is missing one or more security updates.


The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0136-1 advisory.

- Mozilla: Iframe sandbox bypass with XSLT (CVE-2021-4140)

- Mozilla: Race condition when playing audio files (CVE-2022-22737)

- Mozilla: Heap-buffer-overflow in blendGaussianBlur (CVE-2022-22738)

- Mozilla: Missing throttling on external protocol launch dialog (CVE-2022-22739)

- Mozilla: Use-after-free of ChannelEventQueue::mOwner (CVE-2022-22740)

- Mozilla: Browser window spoof using fullscreen mode (CVE-2022-22741)

- Mozilla: Out-of-bounds memory access when inserting text in edit mode (CVE-2022-22742)

- When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode. (CVE-2022-22743)

- The constructed curl command from the Copy as curl feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if pasted into a Powershell prompt. This bug only affects Firefox for Windows. Other operating systems are unaffected. (CVE-2022-22744)

- Mozilla: Leaking cross-origin URLs through securitypolicyviolation event (CVE-2022-22745)

- A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed. This bug only affects Thunderbird for Windows. Other operating systems are unaffected. (CVE-2022-22746)

- Mozilla: Crash when handling empty pkcs7 sequence (CVE-2022-22747)

- Mozilla: Spoofed origin on external protocol launch dialog (CVE-2022-22748)

- Mozilla: Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5 (CVE-2022-22751)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.


Update the affected packages.

See Also

Plugin Details

Severity: High

ID: 156943

File Name: openSUSE-2022-0136-1.nasl

Version: 1.3

Type: local

Agent: unix

Published: 1/21/2022

Updated: 2/21/2022

Supported Sensors: Nessus Agent

Risk Information

CVSS Score Source: CVE-2022-22745


Risk Factor: Medium

Score: 6.7


Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: E:U/RL:OF/RC:C


Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:MozillaFirefox, p-cpe:/a:novell:opensuse:MozillaFirefox-branding-upstream, p-cpe:/a:novell:opensuse:MozillaFirefox-devel, p-cpe:/a:novell:opensuse:MozillaFirefox-translations-common, p-cpe:/a:novell:opensuse:MozillaFirefox-translations-other, cpe:/o:novell:opensuse:15.3

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 1/20/2022

Vulnerability Publication Date: 1/11/2022

Reference Information

CVE: CVE-2021-4140, CVE-2022-22737, CVE-2022-22738, CVE-2022-22739, CVE-2022-22740, CVE-2022-22741, CVE-2022-22742, CVE-2022-22743, CVE-2022-22744, CVE-2022-22745, CVE-2022-22746, CVE-2022-22747, CVE-2022-22748, CVE-2022-22751

IAVA: 2022-A-0017-S