CVE-2022-29914: Medium severity Mozilla Firefox vulnerability
When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks.
Other sources
When reusing existing popups Thunderbird would allow them to cover the fullscreen notification UI, which could enable browser spoofing attacks.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 91.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 100 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 91.9 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 100.0-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 91.9.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 100.0-r0 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 91.9.0-r0 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.9.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:91.9.0-1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2022-29914?
CVE-2022-29914 has a severity rating that allows for browser spoofing attacks by covering the fullscreen notification UI.
How do I fix CVE-2022-29914?
To fix CVE-2022-29914, update your Firefox, Firefox ESR, or Thunderbird to versions 91.9 or 100 as applicable.
Which software is affected by CVE-2022-29914?
CVE-2022-29914 affects Mozilla Firefox, Firefox ESR, and Thunderbird versions prior to 91.9 or 100.
What type of attack does CVE-2022-29914 enable?
CVE-2022-29914 enables browser spoofing attacks by allowing popups to obscure important user interface elements.
When was CVE-2022-29914 disclosed?
CVE-2022-29914 was publicly disclosed in 2022, leading to the issuance of security advisories by Mozilla.