MOZILLA FIREFOX THUNDERBIRD UPDATE
MOZILLA FIREFOX THUNDERBIRD DRIVER
MOZILLA FIREFOX THUNDERBIRD PORTABLE
MOZILLA FIREFOX THUNDERBIRD ANDROID
MOZILLA FIREFOX THUNDERBIRD CODE

ThunderbirdĬVE-2022-3033: (High) Leaking of sensitive information when composing a response to an HTML email with a META refresh tag. ARM64 is the architecture used by newer Macs built on Apple Silicon, shipped in late 2020 and beyond. This bug only affects Firefox on ARM64 platforms.

MOZILLA FIREFOX THUNDERBIRD PORTABLE

Wasm is designed as a portable compilation target for programming languages, enabling deployment on the web for client and server applications.

MOZILLA FIREFOX THUNDERBIRD CODE

Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash. The HTTP CSP base-uri directive restricts the URLs which can be used in a document's element.ĬVE-2022-40957: (Low) Incoherent instruction cache when building WASM on ARM64. When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. Other operating systems are not affected.ĬVE-2022-40956: (Low) Content-Security-Policy (CSP) base-uri bypass.

MOZILLA FIREFOX THUNDERBIRD DRIVER

During startup, a graphics driver with an unexpected name could lead to a stack-buffer overflow causing a potentially exploitable crash. This issue only affects Firefox for Android. In such a case the attack is initiated before the user logs in and the session fixation attack fixes an established session on the victim's browser.ĬVE-2022-40961: (Moderate) Stack-buffer overflow when initializing Graphics. In a session fixation attack, the attacker already has access to a valid session and tries to force the victim to use that particular session for his or her own purposes. By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other attacks. Some of these bugs showed evidence of memory corruption and it is likely that with enough effort some of these could have been exploited to run arbitrary code.ĬVE-2022-40958: (Moderate) Bypassing Secure Context restriction for cookies with _Host and _Secure prefix. These bugs were found by Mozilla developers and the Mozilla Fuzzing Team. Or they could be constructed to exploit this vulnerability.ĬVE-2022-40962: (High )Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3. Since UTF-8 as character encoding was introduced in 2005, there may be still some URLs which use a different encoding. A non-UTF-8 character is a sequence of bytes that is not a valid UTF-8 character. It can translate any Unicode character into a matching unique binary string. UTF-8 is an encoding system for Unicode characters. This could lead to a use-after-free causing a potentially exploitable crash. Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. The HTTP Feature-Policy header provides a mechanism to allow and deny the use of browser features in its own frame, and in content within any iframe elements in the document.ĬVE-2022-40960: (High) Data-race when parsing non-UTF-8 URLs in threads. During iframe navigation, certain pages didn't have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments. Stay safe everyone! The technical details Firefox vulnerabilitiesĬVE-2022-40959: (High) Bypassing FeaturePolicy restrictions on transient pages. Once you've updated, you're protected against these vulnerabilities. The screens and the way to access them are largely the same for all Mozilla programs, including Thunderbird.

MOZILLA FIREFOX THUNDERBIRD UPDATE

Use the Update button next to it.ĭownloading available update screen Firefox

MOZILLA FIREFOX THUNDERBIRD ANDROID

This will show which version you currently have and whether an update is available. On Android use the My apps & games item in the PlayStore side-menu and find Firefox Browser in the list.

On a Mac, look at the top menu and click Firefox > About Firefox. To find out which version you are using on a Windows machine, open the application menu and click on Help > About.

Thunderbird is Mozilla’s free email application. Firefox Extended Support Release (ESR) is an official version of Firefox developed for large organizations that need to set up and maintain Firefox on a large scale. Firefox 105 is the browser most Mozilla users will have on their system. Security advisories were published for Firefox 105, Firefox ESR 102.3, and Thunderbird 91.13.1.

In Thunderbird three security vulnerabilities were patched. In Firefox 105 a total of seven vulnerabilities were patched, three of which received the security risk rating 'high'. An attacker could exploit some of these vulnerabilities to take control of an affected system. Mozilla has released security updates to address vulnerabilities in Firefox, Firefox ESR, and Thunderbird.

Mozilla firefox thunderbird