Поиск уязвимостей

Уязвимость службы Mozilla Maintenance браузеров Mozilla Firefox, Focus for Android, Mozilla Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю получить доступ на чтение, изменение или удаление данных

A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.

A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.

A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.

A local attacker can trick the Mozilla Maintenance Service into applyi ...

ALT-PU-2023-1797: package `firefox-esr` update to version 102.10.0-alt1

ALT-PU-2023-1649: package `firefox-esr` update to version 102.10.0-alt1

ALT-PU-2023-1783: package `thunderbird` update to version 102.10.0-alt1

ALT-PU-2023-1648: package `thunderbird` update to version 102.10.0-alt1

A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.

ALT-PU-2023-1621: package `firefox` update to version 112.0-alt1

ALT-PU-2023-1817: package `firefox` update to version 112.0.2-alt0.p10.1

ALT-PU-2022-2306: package `firefox` update to version 103.0-alt1

Security update for MozillaFirefox

Security update for MozillaFirefox

Security update for MozillaFirefox

Множественные уязвимости firefox

Security update for MozillaThunderbird

Множественные уязвимости thunderbird

ALT-PU-2022-2930: package `firefox` update to version 105.0.1-alt0.p10.1