Linux · Security advisory · March 10, 2022
RHSA-2022:0818: firefox security update
RHSA-2022:0818, released March 10, 2022, fixes 13 CVEs in firefox (version 0:91.7.0-3.el8_5). 2 of them are being exploited (CVE-2022-26485); 2 on CISA KEV. Patch Radar priority: Patch now.
Patch now2 on CISA KEV
CVEs closed
13
7 rated Critical
Exploited
2
CVE-2022-26485
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.3527
98th percentile
Priority of the 13 CVEs
Patch now 2
Urgent 5
High 6
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| firefox | RHEL 8 | 0:91.7.0-3.el8_5 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Patch now | CVE-2022-26485 | Mozilla Firefox Use-After-Free Vulnerability | 9.8 | 0.1426 | KEVExploited | |
| Patch now | CVE-2022-26486 | Mozilla Firefox Use-After-Free Vulnerability | 9.8 | 0.0236 | KEVExploited | |
| Urgent | CVE-2022-26384 | Mozilla Thunderbird and 4 others: Protection Mechanism Failure | 9.8 | 0.0097 | None reported | |
| Urgent | CVE-2022-26381 | Mozilla Thunderbird and 4 others: Use After Free | 9.8 | 0.0087 | None reported | |
| Urgent | CVE-2022-26386 | firefox: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This... | 9.8 | 0.0071 | None reported | |
| Urgent | CVE-2022-26383 | Mozilla Thunderbird and 4 others: User Interface (UI) Misrepresentation of Critical Information | 9.8 | 0.0070 | None reported | |
| Urgent | CVE-2022-26387 | Mozilla Thunderbird and 4 others: Time-of-check Time-of-use (TOCTOU) Race Condition | 9.8 | 0.0066 | None reported | |
| High | CVE-2022-25236 | libxmltok1: xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namesp... | 9.8 | 0.3527 | None reported | |
| High | CVE-2022-22822 | xul-ext-lightning: addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 9.8 | 0.0548 | None reported | |
| High | CVE-2022-25235 | libxmltok1: xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a... | 9.8 | 0.0496 | None reported | |
| High | CVE-2022-25315 | expat: In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. | 9.8 | 0.0482 | None reported | |
| High | CVE-2022-22823 | thunderbird-mozsymbols: build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 9.8 | 0.0387 | None reported | |
| High | CVE-2022-22824 | expat: defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 9.8 | 0.0387 | None reported |
Showing 1 to 13 of 13
1