{"id":25666,"date":"2022-03-16T01:15:15","date_gmt":"2022-03-15T17:15:15","guid":{"rendered":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/?p=25666"},"modified":"2022-03-16T01:16:04","modified_gmt":"2022-03-15T17:16:04","slug":"%e3%80%90%e6%bc%8f%e6%b4%9e%e9%a0%90%e8%ad%a6%e3%80%91mozilla-firefox%e3%80%81firefox-esr%e3%80%81firefox-for-android%e3%80%81focus%e5%8f%8athunderbird%e7%ad%89%e7%94%a2%e5%93%81%e5%ad%98%e5%9c%a8","status":"publish","type":"post","link":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/archives\/25666","title":{"rendered":"\u3010\u6f0f\u6d1e\u9810\u8b66\u3011Mozilla Firefox\u3001Firefox ESR\u3001Firefox for Android\u3001Focus\u53caThunderbird\u7b49\u7522\u54c1\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e(CVE-2022-26485\u8207CVE-2022-26486)\uff0c\u5141\u8a31\u653b\u64ca\u8005\u9060\u7aef\u57f7\u884c\u4efb\u610f\u7a0b\u5f0f\u78bc\uff0c\u8acb\u5118\u901f\u78ba\u8a8d\u4e26\u9032\u884c\u66f4\u65b0"},"content":{"rendered":"

\u6559\u80b2\u6a5f\u69cbANA\u901a\u5831\u5e73\u53f0<\/h3>\n\n\n\n\n\n\n\n\n\n\n
\u767c\u4f48\u7de8\u865f<\/td>\nTACERT-ANA-2022030901035959<\/td>\n\u767c\u4f48\u6642\u9593<\/td>\n2022-03-09 13:30:00<\/td>\n<\/tr>\n
\u4e8b\u6545\u985e\u578b<\/td>\nANA-\u6f0f\u6d1e\u9810\u8b66<\/td>\n\u767c\u73fe\u6642\u9593<\/td>\n2022-03-09 13:13:00<\/td>\n<\/tr>\n
\u5f71\u97ff\u7b49\u7d1a<\/td>\n\u4e2d<\/td>\n<\/td>\n<\/td>\n<\/tr>\n
[\u4e3b\u65e8\u8aaa\u660e:]\u3010\u6f0f\u6d1e\u9810\u8b66\u3011Mozilla Firefox\u3001Firefox ESR\u3001Firefox for Android\u3001Focus\u53caThunderbird\u7b49\u7522\u54c1\u5b58\u5728<\/wbr>\u5b89\u5168\u6f0f\u6d1e(CVE-2022-26485\u8207CVE-2022-<\/wbr>26486)\uff0c\u5141\u8a31\u653b\u64ca\u8005\u9060\u7aef\u57f7\u884c\u4efb\u610f\u7a0b\u5f0f\u78bc\uff0c<\/wbr>\u8acb\u5118\u901f\u78ba\u8a8d\u4e26\u9032\u884c\u66f4\u65b0<\/td>\n<\/tr>\n
[\u5167\u5bb9\u8aaa\u660e:]<\/p>\n

\u8f49\u767c \u570b\u5bb6\u8cc7\u5b89\u8cc7\u8a0a\u5206\u4eab\u8207\u5206\u6790\u4e2d\u5fc3 NISAC-ANA-202203-0389<\/p>\n

\u7814\u7a76\u4eba\u54e1\u767c\u73feMozilla Firefox\u3001Firefox ESR\u3001Firefox for Android\u3001<\/wbr>Focus\u53caThunderbird\u7b49\u7522\u54c1\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e(<\/wbr>CVE-2022-26485\u8207CVE-2022-26486)<\/wbr>\uff0c\u8087\u56e0\u65bc\u53c3\u6578\u8655\u7406\u904e\u7a0b\u4e2d\u79fb\u9664XSLT\u53c3\u6578\uff0c<\/wbr>\u9020\u6210\u4f7f\u7528\u91cb\u653e\u5f8c\u8a18\u61b6\u9ad4(Use-after-free)\u6f0f\u6d1e\uff0c<\/wbr>\u6216\u56e0\u53c3\u6578\u6aa2\u67e5\u4e0d\u8db3\uff0c\u5c0e\u81f4WebGPU IPC\u6846\u67b6\u5b58\u5728\u6c99\u7bb1\u9003\u9038(Sandbox escape)\u6f0f\u6d1e\uff0c\u7d50\u5408\u4e0a\u8ff0\u5169\u500b\u6f0f\u6d1e\uff0c<\/wbr>\u5c07\u5141\u8a31\u653b\u64ca\u8005\u9060\u7aef\u57f7\u884c\u4efb\u610f\u7a0b\u5f0f\u78bc\uff0c<\/wbr>\u4e14Mozilla\u8868\u793a\u5df2\u767c\u73fe\u6709\u653b\u64ca\u7a0b\u5f0f\u5229\u7528\u6f0f\u6d1e\u767c\u52d5\u653b\u64ca\u3002<\/p>\n

\u60c5\u8cc7\u5206\u4eab\u7b49\u7d1a: WHITE(\u60c5\u8cc7\u5167\u5bb9\u70ba\u53ef\u516c\u958b\u63ed\u9732\u4e4b\u8cc7\u8a0a)<\/td>\n<\/tr>\n

[\u5f71\u97ff\u5e73\u53f0:]<\/p>\n

\u25cf Firefox 97.0.2\u4ee5\u524d\u7248\u672c<\/p>\n

\u25cf Firefox ESR 91.6.1\u4ee5\u524d\u7248\u672c<\/p>\n

\u25cf Firefox for Android 97.3\u4ee5\u524d\u7248\u672c<\/p>\n

\u25cf Firefox Focus 97.3\u4ee5\u524d\u7248\u672c<\/p>\n

\u25cf Mozilla Thunderbird 91.6.2\u4ee5\u524d\u7248\u672c<\/td>\n<\/tr>\n

[\u5efa\u8b70\u63aa\u65bd:]<\/p>\n

Mozilla\u5df2\u4fee\u88dc\u6f0f\u6d1e\u4e26\u63a8\u51fa\u65b0\u7248\u672c\uff0c<\/wbr>\u8acb\u66f4\u65b0\u5404\u53d7\u5f71\u97ff\u7522\u54c1\u81f3\u6700\u65b0\u7248\u672c\uff0c\u66f4\u65b0\u65b9\u5f0f\u5982\u4e0b\uff1a1.<\/wbr>Firefox\u8207Firefox ESR\u7248\u672c\u6aa2\u67e5\u8207\u66f4\u65b0\u65b9\u5f0f\u5982\u4e0b\uff1a<\/p>\n

(1)\u958b\u555f\u700f\u89bd\u5668\uff0c\u9ede\u64ca\u9078\u55ae\u6309\u9215\uff0c\u9ede\u9078\u300c\u8aaa\u660e\u300d–>\u300c<\/wbr>\u95dc\u65bcFirefox\u300d\uff0c<\/wbr>\u53ef\u67e5\u770b\u7576\u524d\u4f7f\u7528\u4e4bFirefox\u700f\u89bd\u5668\u662f\u5426\u70ba\u53d7\u5f71\u97ff\u4e4b\u7248\u672c\uff0c<\/wbr>\u700f\u89bd\u5668\u5c07\u57f7\u884c\u7248\u672c\u6aa2\u67e5\u8207\u66f4\u65b0\u3002<\/p>\n

(2)\u9ede\u64ca\u300c\u91cd\u65b0\u555f\u52d5\u4ee5\u66f4\u65b0Firefox\u300d\u5b8c\u6210\u66f4\u65b0\u3002<\/p>\n

 <\/p>\n

2.Firefox for Android\u7248\u672c\u6aa2\u67e5\u8207\u66f4\u65b0\u65b9\u5f0f\u5982\u4e0b\uff1a<\/p>\n

(1)\u958b\u555f\u700f\u89bd\u5668\uff0c\u9ede\u64ca\u9078\u55ae\u6309\u9215\uff0c\u9ede\u9078\u300c\u8a2d\u5b9a\u300d–>\u300c<\/wbr>\u95dc\u65bcFirefox\u300d\uff0c\u7248\u672c\u865f\u78bc\u5c07\u6703\u986f\u793a\u5728Firefox Browser\u6587\u5b57\u6a19\u8a8c\u4e0b\u65b9\u3002<\/p>\n

(2)\u53ef\u65bc\u88dd\u7f6e\u4e2d\u4e4bGoogle Play\u5546\u5e97\u6aa2\u67e5\u662f\u5426\u6709\u53ef\u7528\u4e4b\u66f4\u65b0\uff0c\u6709\u53ef\u66f4\u65b0\u4e4b\u7248\u672c\u6642\uff0c<\/wbr>\u5c07\u986f\u793a\u65bc\u53ef\u66f4\u65b0\u5217\u8868\u4e0a\uff0c\u9ede\u9078\u300c\u66f4\u65b0\u300d\u5b8c\u6210\u66f4\u65b0\u3002<\/p>\n

 <\/p>\n

3.Firefox Focus\u7248\u672c\u6aa2\u67e5\u8207\u66f4\u65b0\u65b9\u5f0f\u5982\u4e0b\uff1a<\/p>\n

(1)\u958b\u555f\u700f\u89bd\u5668\uff0c\u9ede\u64ca\u9078\u55ae\u6309\u9215\uff0c\u9ede\u9078\u300c\u9078\u9805\u300d–>\u300c<\/wbr>Mozilla\u300d–>\u300c\u95dc\u65bcFirefox Focus\u300d\u3002\u7248\u672c\u865f\u78bc\u5c07\u6703\u986f\u793a\u5728Firefox Focus\u6587\u5b57\u6a19\u8a8c\u4e0b\u65b9\u3002<\/p>\n

(2)\u53ef\u65bc\u88dd\u7f6e\u4e2d\u4e4bGoogle Play\u5546\u5e97\u6aa2\u67e5\u662f\u5426\u6709\u53ef\u7528\u4e4b\u66f4\u65b0\uff0c\u6709\u53ef\u66f4\u65b0\u4e4b\u7248\u672c\u6642\uff0c<\/wbr>\u5c07\u986f\u793a\u65bc\u53ef\u66f4\u65b0\u5217\u8868\u4e0a\uff0c\u9ede\u9078\u300c\u66f4\u65b0\u300d\u5b8c\u6210\u66f4\u65b0\u3002<\/p>\n

 <\/p>\n

4.Thunderbird\u7248\u672c\u6aa2\u67e5\u8207\u66f4\u65b0\u65b9\u5f0f\u5982\u4e0b\uff1a<\/p>\n

(1)\u958b\u555fThunderbird\uff0c\u9ede\u9078\u300c\u8aaa\u660e\u300d–>\u300c<\/wbr>\u95dc\u65bcMozilla Thunderbird\u300d\uff0c\u53ef\u67e5\u770b\u7576\u524d\u4f7f\u7528\u4e4bMozilla Thunderbird\u662f\u5426\u70ba\u53d7\u5f71\u97ff\u4e4b\u7248\u672c\uff0c<\/wbr>\u4e26\u57f7\u884c\u7248\u672c\u6aa2\u67e5\u8207\u66f4\u65b0\u3002<\/p>\n

(2)\u9ede\u64ca\u300c\u91cd\u65b0\u555f\u52d5\u4ee5\u66f4\u65b0Thunderbird\u300d\u5b8c\u6210\u66f4\u65b0\u3002<\/p>\n

 <\/p>\n

5.\u4fdd\u6301\u826f\u597d\u4f7f\u7528\u7fd2\u6163\uff0c\u8acb\u52ff\u9ede\u64ca\u4f86\u8def\u4e0d\u660e\u7684\u7db2\u5740\u9023\u7d50\u3002<\/td>\n<\/tr>\n

[\u53c3\u8003\u8cc7\u6599:]
\n1.\u00a0https:\/\/www.ithome.com.tw\/<\/wbr>news\/149738<\/a>
\n2.\u00a0https:\/\/www.mozilla.org\/en-<\/wbr>US\/security\/advisories\/<\/wbr>mfsa2022-09<\/a>
\n3.\u00a0https:\/\/support.mozilla.<\/wbr>org\/zh-TW\/kb\/update-latest-<\/wbr>version-firefox-android<\/a>
\n4.\u00a0https:\/\/support.mozilla.<\/wbr>org\/en-US\/kb\/updating-<\/wbr>thunderbird<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n\n\n\n\n
(\u6b64\u901a\u5831\u50c5\u5728\u65bc\u544a\u77e5\u76f8\u95dc\u8cc7\u8a0a\uff0c\u4e26\u975e\u70ba\u8cc7\u5b89\u4e8b\u4ef6)\uff0c<\/wbr>\u5982\u679c\u60a8\u5c0d\u6b64\u901a\u5831\u7684\u5167\u5bb9\u6709\u7591\u554f\u6216\u6709\u95dc\u65bc\u6b64\u4e8b\u4ef6\u7684\u5efa\u8b70\uff0c<\/wbr>\u6b61\u8fce\u8207\u6211\u5011\u9023\u7d61\u3002<\/td>\n<\/tr>\n
\u6559\u80b2\u6a5f\u69cb\u8cc7\u5b89\u901a\u5831\u61c9\u8b8a\u5c0f\u7d44
\n\u7db2\u5740\uff1ahttps:\/\/info.cert.tanet.<\/wbr>edu.tw\/<\/a>
\n\u5c08\u7dda\u96fb\u8a71\uff1a07-5250211
\n\u7db2\u8def\u96fb\u8a71\uff1a98400000
\nE-Mail\uff1aservice@cert.tanet.edu.<\/wbr>tw<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"

\u6559\u80b2\u6a5f\u69cbANA\u901a\u5831\u5e73\u53f0 \u767c\u4f48\u7de8\u865f TACERT-ANA-2022030901035959 \u767c\u4f48\u6642\u9593 2022-03-09 13:30:00 \u4e8b\u6545\u985e\u578b ANA-\u6f0f\u6d1e\u9810\u8b66 \u767c\u73fe\u6642\u9593 2022-03-09 13:13:00 \u5f71\u97ff\u7b49\u7d1a \u4e2d [\u4e3b\u65e8\u8aaa\u660e:]\u3010\u6f0f\u6d1e\u9810\u8b66\u3011Mozilla Firefox\u3001Firefox ESR\u3001Firefox for Android\u3001Focus\u53caThunderbird\u7b49\u7522\u54c1\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e(CVE-2022-26485\u8207CVE-2022-26486)\uff0c\u5141\u8a31\u653b\u64ca\u8005\u9060\u7aef\u57f7\u884c\u4efb\u610f\u7a0b\u5f0f\u78bc\uff0c\u8acb\u5118\u901f\u78ba\u8a8d\u4e26\u9032\u884c\u66f4\u65b0 [\u5167\u5bb9\u8aaa\u660e:]<\/p>\n

\u8f49\u767c \u570b\u5bb6\u8cc7\u5b89\u8cc7\u8a0a\u5206\u4eab\u8207\u5206\u6790\u4e2d\u5fc3 NISAC-ANA-202203-0389<\/p>\n

\u7814\u7a76\u4eba\u54e1\u767c\u73feMozilla Firefox\u3001Firefox ESR\u3001Firefox for Android\u3001Focus\u53caThunderbird\u7b49\u7522\u54c1\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e(CVE-2022-26485\u8207CVE-2022-26486)\uff0c\u8087\u56e0\u65bc\u53c3\u6578\u8655\u7406\u904e\u7a0b\u4e2d\u79fb\u9664XSLT\u53c3\u6578\uff0c\u9020\u6210\u4f7f\u7528\u91cb\u653e\u5f8c\u8a18\u61b6\u9ad4(Use-after-free)\u6f0f\u6d1e\uff0c\u6216\u56e0\u53c3\u6578\u6aa2\u67e5\u4e0d\u8db3\uff0c\u5c0e\u81f4WebGPU IPC\u6846\u67b6\u5b58\u5728\u6c99\u7bb1\u9003\u9038(Sandbox escape)\u6f0f\u6d1e\uff0c\u7d50\u5408\u4e0a\u8ff0\u5169\u500b\u6f0f\u6d1e\uff0c\u5c07\u5141\u8a31\u653b\u64ca\u8005\u9060\u7aef\u57f7\u884c\u4efb\u610f\u7a0b\u5f0f\u78bc\uff0c\u4e14Mozilla\u8868\u793a\u5df2\u767c\u73fe\u6709\u653b\u64ca\u7a0b\u5f0f\u5229\u7528\u6f0f\u6d1e\u767c\u52d5\u653b\u64ca\u3002<\/p>\n

\u60c5\u8cc7\u5206\u4eab\u7b49\u7d1a: WHITE(\u60c5\u8cc7\u5167\u5bb9\u70ba\u53ef\u516c\u958b\u63ed\u9732\u4e4b\u8cc7\u8a0a) [\u5f71\u97ff\u5e73\u53f0:]<\/p>\n

\u25cf Firefox 97.0.2\u4ee5\u524d\u7248\u672c<\/p>\n

\u25cf Firefox ESR 91.6.1\u4ee5\u524d\u7248\u672c<\/p>\n

\u25cf Firefox for Android 97.3\u4ee5\u524d\u7248\u672c<\/p>\n

\u25cf Firefox Focus 97.3\u4ee5\u524d\u7248\u672c<\/p>\n

\u25cf Mozilla Thunderbird 91.6.2\u4ee5\u524d\u7248\u672c [\u5efa\u8b70\u63aa\u65bd:]<\/p>\n

Mozilla\u5df2\u4fee\u88dc\u6f0f\u6d1e\u4e26\u63a8\u51fa\u65b0\u7248\u672c\uff0c\u8acb\u66f4\u65b0\u5404\u53d7\u5f71\u97ff\u7522\u54c1\u81f3\u6700\u65b0\u7248\u672c\uff0c\u66f4\u65b0\u65b9\u5f0f\u5982\u4e0b\uff1a1.Firefox\u8207Firefox ESR\u7248\u672c\u6aa2\u67e5\u8207\u66f4\u65b0\u65b9\u5f0f\u5982\u4e0b\uff1a<\/p>\n

[…]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"_links":{"self":[{"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/posts\/25666"}],"collection":[{"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/comments?post=25666"}],"version-history":[{"count":0,"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/posts\/25666\/revisions"}],"wp:attachment":[{"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/media?parent=25666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/categories?post=25666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webnas.bhes.ntpc.edu.tw\/wordpress\/wp-json\/wp\/v2\/tags?post=25666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}