Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to determine the presence or length of a media file. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-firefoxalma-upgrade-thunderbird | Nov 22, 2022 | Nov 21, 2022 | |
| Alpine Linux | alpine-linux-upgrade-firefox-esralpine-linux-upgrade-thunderbirdalpine-linux-upgrade-firefox | Aug 22, 2024 | Dec 22, 2022 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-firefoxamazon-linux-ami-2-upgrade-firefox-debuginfo | Sep 28, 2023 | Dec 22, 2022 | |
| Centos_linux | — | centos-upgrade-firefoxcentos-upgrade-firefox-debuginfocentos-upgrade-firefox-debugsourcecentos-upgrade-thunderbirdcentos-upgrade-thunderbird-debuginfocentos-upgrade-thunderbird-debugsource | Nov 22, 2022 | Nov 21, 2022 |
| Debian | debian-upgrade-firefox-esrdebian-upgrade-thunderbird | Nov 18, 2022 | Nov 18, 2022 | |
| Gentoo Linux | gentoo-linux-upgrade-mail-client-thunderbirdgentoo-linux-upgrade-mail-client-thunderbird-bingentoo-linux-upgrade-www-client-firefoxgentoo-linux-upgrade-www-client-firefox-bin | Nov 23, 2022 | Nov 22, 2022 | |
| Mfsa2022 47 | mozilla-firefox-upgrade-107_0 | Nov 16, 2022 | Nov 15, 2022 | |
| Mfsa2022 48 | mozilla-firefox-esr-upgrade-102_5 | Nov 16, 2022 | Nov 15, 2022 | |
| Mozilla Thunderbird | mozilla-thunderbird-upgrade-102_5 | Nov 16, 2022 | Nov 15, 2022 | |
| Oracle_linux | — | oracle-linux-upgrade-firefoxoracle-linux-upgrade-thunderbird | Nov 22, 2022 | Nov 15, 2022 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-firefoxredhat-upgrade-firefox-debuginforedhat-upgrade-firefox-debugsourceredhat-upgrade-thunderbirdredhat-upgrade-thunderbird-debuginforedhat-upgrade-thunderbird-debugsource | Nov 22, 2022 | Nov 21, 2022 | |
| Rocky_linux | rocky-upgrade-firefoxrocky-upgrade-firefox-debuginforocky-upgrade-firefox-debugsourcerocky-upgrade-thunderbirdrocky-upgrade-thunderbird-debuginforocky-upgrade-thunderbird-debugsource | Mar 12, 2024 | Dec 22, 2022 | |
| Suse | — | suse-upgrade-mozillafirefoxsuse-upgrade-mozillafirefox-branding-upstreamsuse-upgrade-mozillafirefox-develsuse-upgrade-mozillafirefox-translations-commonsuse-upgrade-mozillafirefox-translations-othersuse-upgrade-mozillathunderbirdsuse-upgrade-mozillathunderbird-translations-commonsuse-upgrade-mozillathunderbird-translations-other | Nov 18, 2022 | Nov 17, 2022 |
| Ubuntu | ubuntu-upgrade-firefoxubuntu-upgrade-thunderbird | Nov 17, 2022 | Nov 16, 2022 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Dec 22, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub