CVE-2022-26387
First published: Tue Mar 08 2022(Updated: )
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified, and Firefox would not have noticed.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/firefox | <0:91.7.0-3.el7_9 | 0:91.7.0-3.el7_9 |
| redhat/thunderbird | <0:91.7.0-2.el7_9 | 0:91.7.0-2.el7_9 |
| redhat/firefox | <0:91.7.0-3.el8_5 | 0:91.7.0-3.el8_5 |
| redhat/thunderbird | <0:91.7.0-2.el8_5 | 0:91.7.0-2.el8_5 |
| redhat/firefox | <0:91.7.0-3.el8_1 | 0:91.7.0-3.el8_1 |
| redhat/thunderbird | <0:91.7.0-2.el8_1 | 0:91.7.0-2.el8_1 |
| redhat/firefox | <0:91.7.0-3.el8_2 | 0:91.7.0-3.el8_2 |
| redhat/thunderbird | <0:91.7.0-2.el8_2 | 0:91.7.0-2.el8_2 |
| redhat/firefox | <0:91.7.0-3.el8_4 | 0:91.7.0-3.el8_4 |
| redhat/thunderbird | <0:91.7.0-2.el8_4 | 0:91.7.0-2.el8_4 |
| redhat/firefox | <91.7 | 91.7 |
| redhat/thunderbird | <91.7 | 91.7 |
| Thunderbird | <91.7 | 91.7 |
| Firefox | <98.0 | |
| Firefox ESR | <91.7 | |
| Thunderbird | <91.7 | |
| Firefox | <98 | 98 |
| Firefox ESR | <91.7 | 91.7 |
| <98.0 | ||
| <91.7 | ||
| <91.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1752979
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-11/
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-10/
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-11/#CVE-2022-26386
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-12/
- https://www.mozilla.org/security/advisories/mfsa2022-10/
- https://www.mozilla.org/security/advisories/mfsa2022-11/
- https://www.mozilla.org/security/advisories/mfsa2022-12/
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-11/#CVE-2022-26387
- https://access.redhat.com/errata/RHSA-2022:0815
- https://access.redhat.com/errata/RHSA-2022:0816
- https://access.redhat.com/errata/RHSA-2022:0818
- https://access.redhat.com/errata/RHSA-2022:0817
- https://access.redhat.com/errata/RHSA-2022:0824
- https://access.redhat.com/errata/RHSA-2022:0843
- https://access.redhat.com/errata/RHSA-2022:0847
- https://access.redhat.com/errata/RHSA-2022:0845
- https://access.redhat.com/errata/RHSA-2022:0853
- https://access.redhat.com/errata/RHSA-2022:0850
- https://access.redhat.com/security/cve/cve-2022-26387
- https://bugzilla.redhat.com/show_bug.cgi?id=2062222
- https://www.cve.org/CVERecord?id=CVE-2022-26387 https://nvd.nist.gov/vuln/detail/CVE-2022-26387
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2022-26387.
What is the severity of CVE-2022-26387?
The severity of CVE-2022-26387 is high (7).
Which software is affected by CVE-2022-26387?
The software affected by CVE-2022-26387 includes Mozilla Firefox ESR (version up to 91.7), Firefox (version up to 98), and Thunderbird (version up to 91.7).
How can I fix CVE-2022-26387?
To fix CVE-2022-26387, update Mozilla Firefox ESR to version 91.7 or later, Firefox to version 98 or later, and Thunderbird to version 91.7 or later.
Where can I find more information about CVE-2022-26387?
More information about CVE-2022-26387 can be found in the following references: [Link 1](https://bugzilla.mozilla.org/show_bug.cgi?id=1752979), [Link 2](https://www.mozilla.org/en-US/security/advisories/mfsa2022-12/), [Link 3](https://www.mozilla.org/en-US/security/advisories/mfsa2022-10/).
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- agent/references
- agent/severity
- agent/weakness
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-26387
- agent/software-canonical-lookup
- agent/description
- agent/event
- agent/trending
- agent/source
- collector/mozilla-advisory
- source/Mozilla
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- package-manager/redhat
- vendor/mozilla
- canonical/thunderbird
- canonical/firefox
- canonical/firefox esr