CVE-2022-22761: High severity Mozilla Firefox vulnerability
Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 91.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 97 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 91.6 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 97.0-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 91.6.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 97.0-r0 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 91.6.0-r0 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:91.6.0-1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2022-22761?
CVE-2022-22761 has been classified as a high severity vulnerability due to improper enforcement of security policies.
How do I fix CVE-2022-22761?
To mitigate CVE-2022-22761, update to Mozilla Firefox version 97 or later, or Mozilla Firefox ESR version 91.6 or later.
Which software is affected by CVE-2022-22761?
CVE-2022-22761 affects Mozilla Firefox, Firefox ESR, and Thunderbird versions below 97 and 91.6 respectively.
What is the nature of the issue in CVE-2022-22761?
CVE-2022-22761 involves web-accessible extension pages not properly enforcing the frame-ancestors directive in Content Security Policy.
Can CVE-2022-22761 lead to cross-site scripting attacks?
Yes, CVE-2022-22761 can increase the risk of cross-site scripting attacks due to the lack of proper security policy enforcement.