Vulnerability CVE-2022-45421: Information

Description

Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

Severity: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2022-45421
Published: Dec. 22, 2022
Modified: Aug. 8, 2023
Error type identifier: CWE-787

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus107.0-alt1126.0-alt1ALT-PU-2022-3090-1310119Fixed
firefoxp10107.0-alt0.p10.1118.0.2-alt0.p10.1ALT-PU-2022-3270-1310328Fixed
firefoxc10f1107.0-alt0.p10.1112.0.2-alt0.p10.1ALT-PU-2022-3270-1310328Fixed
firefox-esrsisyphus102.5.0-alt1115.10.0-alt1ALT-PU-2022-3099-1310102Fixed
firefox-esrp10102.5.0-alt2115.10.0-alt1ALT-PU-2022-3340-1311456Fixed
firefox-esrp9102.6.0-alt0.c9.1102.11.0-alt0.c9.1ALT-PU-2023-4336-1319683Fixed
firefox-esrc10f1115.8.0-alt0.c10.1115.9.1-alt0.c10.1ALT-PU-2024-3614-2340631Fixed
firefox-esrc9f2102.6.0-alt0.c9.1102.12.0-alt0.c9.1ALT-PU-2023-1138-1309126Fixed
thunderbirdsisyphus102.5.0-alt1115.9.0-alt1ALT-PU-2022-3097-1310101Fixed
thunderbirdp10102.5.0-alt1115.9.0-alt1ALT-PU-2022-3209-1310334Fixed
thunderbirdp9102.7.1-alt1102.11.0-alt0.c9.1ALT-PU-2023-4335-1319683Fixed
thunderbirdc10f1102.5.0-alt1115.9.0-alt0.c10.1ALT-PU-2022-3209-1310334Fixed
thunderbirdc9f2102.6.1-alt1102.11.0-alt0.c9.1ALT-PU-2023-1137-1309126Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1767920%2C1789808%2C1794061
  • Issue Tracking
  • Not Applicable
https://www.mozilla.org/security/advisories/mfsa2022-49/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-48/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-47/
  • Vendor Advisory

    1. Configuration 1

      cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
      End excliding
      107.0
      cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
      End excliding
      102.5
      cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
      End excliding
      102.5
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.1
Back to top