CVE-2022-29916: Infoleak
Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the browser history.
Other sources
Thunderbird would behave slightly differently for already known resources, when loading CSS resources through resolving CSS variables. This could be used to probe the browser history.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 91.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 100 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 91.9 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 100.0-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 91.9.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 100.0-r0 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 91.9.0-r0 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.9.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:91.9.0-1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2022-29916?
The severity of CVE-2022-29916 is classified as moderate.
How do I fix CVE-2022-29916?
To fix CVE-2022-29916, users should update Firefox to version 100 or later for general releases and to Firefox ESR version 91.9 or later.
What software is affected by CVE-2022-29916?
CVE-2022-29916 affects Mozilla Firefox versions up to 100, Mozilla Firefox ESR versions up to 91.9, and Mozilla Thunderbird versions up to 91.9.
Can CVE-2022-29916 lead to data leakage?
Yes, CVE-2022-29916 can be exploited to potentially probe and leak browser history.
Is CVE-2022-29916 a remote attack vector?
CVE-2022-29916 can be exploited via a remote attack if the user visits a malicious website.