PT-2022-4925 · Mozilla+4 · Firefox+4

Young Min Kim · Published 2022-03-08 · Updated 2024-12-12 · CVE-2022-26382

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 98

Description The issue is related to the Autofill tooltips in Firefox, where the text displayed cannot be directly read by JavaScript but is rendered using page fonts. This could lead to side-channel attacks using specially crafted fonts, potentially allowing an attacker to infer the text. The vulnerability is associated with a lack of protection for sensitive data, which could enable an unauthorized party to access protected information.

Recommendations For versions prior to 98, update to version 98 or later to resolve the issue. As a temporary workaround, consider restricting the use of Autofill tooltips until a patch is applied. Avoid using specially crafted fonts that could be used in side-channel attacks.

Exploit

Fix

Information Disclosure

Side Channel Attack

Weakness Enumeration

CWE-200

CWE-203

Related Identifiers

ALT-PU-2022-1450

ALT-PU-2022-2458

ALT-PU-2022-2929

ALT-PU-2022-2930

ALT-PU-2023-1138

ALT-PU-2023-1139

ALT-PU-2023-4336

ALT-PU-2023-4339

BDU:2022-06106

CVE-2022-26382

OESA-2023-1673

OESA-2023-1674

OPENSUSE-SU-2024:11908-1

OPENSUSE-SU-2024:14572-1

USN-5321-1

USN-5321-2

USN-5321-3

Affected Products

Alt Linux

Astra Linux

Firefox

Linuxmint

Ubuntu

References · 2185

• 🔥 https://github.com/mistymntncop/CVE-2022-1802 · Exploit
• 🔥 https://github.com/0vercl0k/CVE-2022-28281 · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-26485 · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1741888 · Exploit
• 🔥❌ https://github.com/MagicPwnrin/CVE-2022-28282 · Exploit, Deleted
• 🔥❌ https://github.com/Pwnrin/CVE-2022-28282 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2021-23968 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-45408 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2022-10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4046 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22748 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-34471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22757 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-29539 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-32205 · Security Note