Join the Mozilla’s Test Days event from Dec 2–8 to test the new Firefox address bar on Firefox Beta 134 and get a chance to win Mozilla swag vouchers! 🎁

為了改善您的使用體驗,本網站正在進行維護,部分功能暫時無法使用。若本站的文件無法解決您的問題,想要向社群發問的話,請到 Twitter 上的 @FirefoxSupport 或 Reddit 上的 /r/firefox 發問,我們的社群成員將很快會回覆您的疑問。

搜尋 Mozilla 技術支援網站

防止技術支援詐騙。我們絕對不會要求您撥打電話或發送簡訊,或是提供個人資訊。請用「回報濫用」功能回報可疑的行為。

了解更多

Firefox ESR 91.12

  • 9 回覆
  • 0 有這個問題
  • 1 次檢視
  • 最近回覆由 Mike Kaply

more options

Hello, Qualys is detecting Vulnerabilites on our Firefox ESR 91.12 Versions which were patched by MFSA2022-29.

It is showing Vulnerabilities because MFSA2022-30 lists CVE's for ESR 102.X and we are on 91.12.

Is there anywhere I can go to get a list of all Vulnerabilities on 91.X to show our Security team, I believe CVE-2022-36314 and CVE-2022-2505 are not present in 91.12 because they are not listed in https://www.mozilla.org/en-US/security/advisories/mfsa2022-29/ but need evidence

Thank You,

Hello, Qualys is detecting Vulnerabilites on our Firefox ESR 91.12 Versions which were patched by MFSA2022-29. It is showing Vulnerabilities because MFSA2022-30 lists CVE's for ESR 102.X and we are on 91.12. Is there anywhere I can go to get a list of all Vulnerabilities on 91.X to show our Security team, I believe CVE-2022-36314 and CVE-2022-2505 are not present in 91.12 because they are not listed in https://www.mozilla.org/en-US/security/advisories/mfsa2022-29/ but need evidence Thank You,

被選擇的解決方法

CVE-2022-36314 was not fixed in Firefox 91 ESR.

See:

https://bugzilla.mozilla.org/show_bug.cgi?id=1773894#c25

ESR was not affected by CVE-2022-2505.

從原來的回覆中察看解決方案 👍 0

所有回覆 (9)

more options

I can't speak for Qualys, but it looks like there is a 91.13.0esr out today. Maybe that will help?

more options

Thank you for the Reply. This doesn't help though. Is CVE-2022-36314 and CVE-2022-2505 present in ESR 91.12.

more options

As you have seen, there is no indication in the Mozilla security alerts that Firefox 91.x is affected by the local .lnk issue. The bug report linked in the alert typically is confidential. Maybe someone who reads this thread is authorized to read it (I am not).

more options

Thank you for the information on the local .lnk issue. Is there anyway to get someone who has authority to reply regarding this?

more options

Btw the Fx 91.13.0 ESR Released today is the last main update for the old Fx 91.0 ESR channel as when Fx 105.0 is Released there will only be the Fx 102.3 ESR for a supported ESR version.

more options

Thank you for the information, we did update to 91.13 and will work with the owner of the server to get ESR updated to 102.3 next month. In the meantime, I need to prove CVE-2022-36314 and CVE-2022-2505 are not present in ESR 91.12, can someone please respond with the answer to the question.

Thank You,

more options

選擇的解決方法

CVE-2022-36314 was not fixed in Firefox 91 ESR.

See:

https://bugzilla.mozilla.org/show_bug.cgi?id=1773894#c25

ESR was not affected by CVE-2022-2505.

more options

Thank you Mike! So CVE-2022-36314 is present in ESR 91.12?

more options

> Thank you Mike! So CVE-2022-36314 is present in ESR 91.12?

It was both complex and not a high severity issue and 102 ESR can be used.