Поиск уязвимостей

Уязвимость браузеров Mozilla Firefox, Focus for Android, Mozilla Firefox ESR и почтового клиента Thunderbird, связанная с неправильной обработкой директивы заголовка Content-Disposition, позволяющая нарушителю обойти ограничения безопасности и загрузить произвольные файлы

ALT-PU-2023-5706: package `palemoon` update to version 32.4.0-alt1

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

When handling the filename directive in the Content-Disposition header ...

ALT-PU-2023-7774: package `palemoon` update to version 32.5.1-alt1

ALT-PU-2023-1797: package `firefox-esr` update to version 102.10.0-alt1

ALT-PU-2023-1649: package `firefox-esr` update to version 102.10.0-alt1

ALT-PU-2023-1783: package `thunderbird` update to version 102.10.0-alt1

ALT-PU-2023-1648: package `thunderbird` update to version 102.10.0-alt1

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

ALT-PU-2023-1621: package `firefox` update to version 112.0-alt1

ALT-PU-2023-1817: package `firefox` update to version 112.0.2-alt0.p10.1

ELSA-2023-1791: firefox security update (IMPORTANT)

ELSA-2023-1787: firefox security update (IMPORTANT)

ELSA-2023-1786: firefox security update (IMPORTANT)

ALT-PU-2022-2306: package `firefox` update to version 103.0-alt1

Important: thunderbird security update

Important: thunderbird security update