Opened 3 years ago
Closed 3 years ago
#16185 closed enhancement (fixed)
seamonkey-2.53.11
| Reported by: | Bruce Dubbs | Owned by: | Douglas R. Reno |
|---|---|---|---|
| Priority: | high | Milestone: | 11.2 |
| Component: | BOOK | Version: | git |
| Severity: | normal | Keywords: | |
| Cc: |
Description ¶
New point version.
Change History (5)
comment:1 by , 3 years ago
| Owner: | changed from to |
|---|---|
| Priority: | normal → high |
| Status: | new → assigned |
comment:2 by , 3 years ago
SeaMonkey 2.53.11 contains (among other changes) the following major changes relative to SeaMonkey 2.53.10.2:
Remove obsolete MOZ_EXTENSIONS check in suite bug 1749146.
Add connect button to cZ Networks Editor bug 1736443.
Remove freenode remnants from ChatZilla in SeaMonkey bug 1741082.
Prefer secure over insecure protocol in network list in ChatZilla bug 1744440.
Composer - Change tag textbox is not removed after use bug 1755369.
Clean up repo links in debugQA bug 1746790.
Fix misspelled references to macOS in suite bug 1749144.
Remove obsolete references to Java and Flash bug 1749141.
Help button not working in delete cert dialog bug 1750386.
Rearrange Message Filter Dialog to make room for new features bug 1735053.
Use Insert key as shortcut to create new message filters bug 1735055.
Rename some variables used in SeaMonkey's FilterListDialog to match Thunderbird's bug 1735056.
Implement Copy to New message filter functionality bug 1735057.
Add move to top / bottom buttons to message filters bug 1735059.
Add preference to not prompt for message filter deletion bug 1735061.
Clean up folder handling in FilterListDialog bug 1736425.
Add refresh function to Filter list dialog so that it can be updated when already open and new filters are added externally bug 1737450.
Use listbox rather than tree in FilterListDialog bug 1746081.
MsgFilterList(args) should take targetFilter and pass it to FilterListDialog bug 1753891.
Mail&News' start.xhtml: "We" link broken bug 1748178.
Add search functionality to filter dialog bug 1749207.
Move the taskbar refresh timer in SeaMonkey to idle dispatch bug 1746788.
Prevent subresource loads from showing the progress indicator on the tab in SeaMonkey bug 1746787.
EDIT: Updated for formatting. I would prefer to use triple {} but it's too long.
comment:3 by , 3 years ago
"Additional important security fixes up to Current Firefox 91.6 ESR and a few enhancements have been backported. We will continue to enhance SeaMonkey security in subsequent 2.53.x beta and release versions as fast as we are able to."
Continuing down that road, I decided to check if the bugfix for 1753094 is present in Seamonkey... and it is: https://gitlab.com/seamonkey-project/seamonkey-2.53-comm/-/commit/a0b21d710e13b8541457f27159177ee6dc66403d
comment:4 by , 3 years ago
This will include fixes from Firefox/Thunderbird 91.4 through 91.6 (91.6.1 in the case of Thunderbird). This includes:
Firefox 91.5.0
Security Vulnerabilities fixed in Firefox ESR 91.5
Announced
January 11, 2022
Impact
high
Products
Firefox ESR
Fixed in
Firefox ESR 91.5
#CVE-2022-22746: Calling into reportValidity could have lead to fullscreen window spoof
Reporter
Irvan Kurniawan
Impact
high
Description
A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.
This bug only affects Thunderbird for Windows. Other operating systems are unaffected.
References
Bug 1735071
#CVE-2022-22743: Browser window spoof using fullscreen mode
Reporter
Irvan Kurniawan
Impact
high
Description
When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode.
References
Bug 1739220
#CVE-2022-22742: Out-of-bounds memory access when inserting text in edit mode
Reporter
Irvan Kurniawan
Impact
high
Description
When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash.
References
Bug 1739923
#CVE-2022-22741: Browser window spoof using fullscreen mode
Reporter
Irvan Kurniawan
Impact
high
Description
When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode.
References
Bug 1740389
#CVE-2022-22740: Use-after-free of ChannelEventQueue::mOwner
Reporter
bo13oy of Cyber Kunlun Lab
Impact
high
Description
Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash.
References
Bug 1742334
#CVE-2022-22738: Heap-buffer-overflow in blendGaussianBlur
Reporter
Atte Kettunen
Impact
high
Description
Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially exploitable crash.
References
Bug 1742382
#CVE-2022-22737: Race condition when playing audio files
Reporter
bo13oy of Cyber Kunlun Lab
Impact
high
Description
Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable crash.
References
Bug 1745874
#CVE-2021-4140: Iframe sandbox bypass with XSLT
Reporter
Peter Van der Beken
Impact
high
Description
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox.
References
Bug 1746720
#CVE-2022-22748: Spoofed origin on external protocol launch dialog
Reporter
Alesandro Ortiz
Impact
moderate
Description
Malicious websites could have confused Thunderbird into showing the wrong origin when asking to launch a program and handling an external URL protocol.
References
Bug 1705211
#CVE-2022-22745: Leaking cross-origin URLs through securitypolicyviolation event
Reporter
Jannis Rautenstrauch
Impact
moderate
Description
Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations
References
Bug 1735856
#CVE-2022-22744: The 'Copy as curl' feature in DevTools did not fully escape website-controlled data, potentially leading to command injection
Reporter
Mattias Jacobsson
Impact
moderate
Description
The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if pasted into a Powershell prompt.
This bug only affects Firefox for Windows. Other operating systems are unaffected.
References
Bug 1737252
#CVE-2022-22747: Crash when handling empty pkcs7 sequence
Reporter
Tavis Ormandy
Impact
low
Description
After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable.
References
Bug 1735028
#CVE-2022-22739: Missing throttling on external protocol launch dialog
Reporter
Alesandro Ortiz
Impact
low
Description
Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol.
References
Bug 1744158
#CVE-2022-22751: Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5
Reporter
Mozilla developers and community
Impact
high
Description
Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR 91.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
References
Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5
Firefox 91.6.0
Security Vulnerabilities fixed in Firefox ESR 91.6
Announced
February 8, 2022
Impact
high
Products
Firefox ESR
Fixed in
Firefox ESR 91.6
#CVE-2022-22753: Privilege Escalation to SYSTEM on Windows via Maintenance Service
Reporter
Seb Patane
Impact
high
Description
A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.
This bug only affects Firefox on Windows. Other operating systems are unaffected.
References
Bug 1732435
#CVE-2022-22754: Extensions could have bypassed permission confirmation during update
Reporter
Rob Wu
Impact
high
Description
If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new version the new requested permissions.
References
Bug 1750565
#CVE-2022-22756: Drag and dropping an image could have resulted in the dropped object being an executable
Reporter
Abdulrahman Alqabandi
Impact
moderate
Description
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it.
References
Bug 1317873
#CVE-2022-22759: Sandboxed iframes could have executed script if the parent appended elements
Reporter
Johan Carlsson
Impact
moderate
Description
If a document created a sandboxed iframe without allow-scripts, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox.
References
Bug 1739957
#CVE-2022-22760: Cross-Origin responses could be distinguished between script and non-script content-types
Reporter
Luan Herrera
Impact
moderate
Description
When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses. This could have been abused to learn information cross-origin.
References
Bug 1740985
Bug 1748503
#CVE-2022-22761: frame-ancestors Content Security Policy directive was not enforced for framed extension pages
Reporter
Mart Gil Robles (Mart at FlowCrypt)
Impact
moderate
Description
Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy.
References
Bug 1745566
#CVE-2022-22763: Script Execution during invalid object state
Reporter
Mozilla Fuzzing Team
Impact
moderate
Description
When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible.
References
Bug 1740534
#CVE-2022-22764: Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
Reporter
Mozilla developers and community
Impact
high
Description
Mozilla developers and community members Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96 and Firefox ESR 91.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
References
Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
Note that Seamonkey is not vulnerable to the matrix/OpenPGP vulnerabilities in Thunderbird-91.4.1, but it is vulnerable to the bug fixed in Thunderbird-91.6.1 (aka bug 1753094):
Security Vulnerabilities fixed in Thunderbird 91.6.1
Announced
February 15, 2022
Impact
high
Products
Thunderbird
Fixed in
Thunderbird 91.6.1
#CVE-2022-0566: Crafted email could trigger an out-of-bounds write
Reporter
Mozilla Fuzzing Team
Impact
high
Description
It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message.
References
Bug 1753094
In total, that means that Seamonkey is affected by the following CVEs:
CVE-2022-22746 CVE-2022-22743 CVE-2022-22742 CVE-2022-22741 CVE-2022-22740 CVE-2022-22738 CVE-2022-22737 CVE-2021-4140 CVE-2022-22748 CVE-2022-22745 CVE-2022-22744 CVE-2022-22747 CVE-2022-22739 CVE-2022-22751 CVE-2022-22754 CVE-2022-22756 CVE-2022-22759 CVE-2022-22760 CVE-2022-22761 CVE-2022-22763 CVE-2022-22764 CVE-2022-0566
comment:5 by , 3 years ago
| Resolution: | → fixed |
|---|---|
| Status: | assigned → closed |
Has the same 0day fix for Thunderbird that allows for system takeover via a crafted email