CVE-2022-46880

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-46880
A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 105. This vulnerability affects Firefox ESR < 102.6, Firefox < 105, and Thunderbird < 102.6.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1749292 Issue Tracking Permissions Required
https://security.gentoo.org/glsa/202305-06
https://security.gentoo.org/glsa/202305-13
https://www.mozilla.org/security/advisories/mfsa2022-40/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-52/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-53/ Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1749292 Issue Tracking Permissions Required
https://security.gentoo.org/glsa/202305-06
https://security.gentoo.org/glsa/202305-13
https://www.mozilla.org/security/advisories/mfsa2022-40/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-52/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-53/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:31

Type Values Removed Values Added
References () https://bugzilla.mozilla.org/show_bug.cgi?id=1749292 - Issue Tracking, Permissions Required () https://bugzilla.mozilla.org/show_bug.cgi?id=1749292 - Issue Tracking, Permissions Required
References () https://security.gentoo.org/glsa/202305-06 - () https://security.gentoo.org/glsa/202305-06 -
References () https://security.gentoo.org/glsa/202305-13 - () https://security.gentoo.org/glsa/202305-13 -
References () https://www.mozilla.org/security/advisories/mfsa2022-40/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2022-40/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2022-52/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2022-52/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2022-53/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2022-53/ - Vendor Advisory
Summary
  • (es) Una verificación faltante relacionada con las unidades tex podría haber provocado un use after free y potencialmente a un bloqueo explotable.<br>*Nota*: Este aviso se agregó el 13 de diciembre de 2022 después de que comprendiéramos mejor el impacto del problema. La solución se incluyó en la versión original de Firefox 105. Esta vulnerabilidad afecta a Firefox ESR &lt; 102.6, Firefox &lt; 105 y Thunderbird &lt; 102.6.
Information

Published : 2022-12-22 20:15

Updated : 2025-04-15 14:15

NVD link : CVE-2022-46880

Mitre link : CVE-2022-46880

CVE.ORG link : CVE-2022-46880

JSON object : View

Products Affected

mozilla

  • thunderbird
  • firefox
  • firefox_esr
CWE
CWE-416

Use After Free