PT-2022-3336 · Mozilla+5 · Firefox+5

Rob Wu

·

Published

2022-06-28

·

Updated

2024-12-12

·

CVE-2022-34471

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:C/A:N
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 102
Description The issue is related to errors in checking downloaded updates, potentially allowing a remote attacker to downgrade the browser version during an update. Specifically, when downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version.
Recommendations For versions prior to 102, update to version 102 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially tampered manifests to minimize the risk of exploitation.

Exploit

Fix

Insufficient Verification of Data Authenticity

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-345

Related Identifiers

ALT-PU-2022-2151
ALT-PU-2022-2458
ALT-PU-2022-2929
ALT-PU-2022-2930
ALT-PU-2023-1138
ALT-PU-2023-1139
ALT-PU-2023-4336
ALT-PU-2023-4339
BDU:2022-04084
CVE-2022-34471
OESA-2023-1673
OESA-2023-1674
OPENSUSE-SU-2022_3396-1
OPENSUSE-SU-2024:12184-1
OPENSUSE-SU-2024:14572-1
SUSE-SU-2022:3272-1
SUSE-SU-2022:3273-1
SUSE-SU-2022:3396-1
USN-5504-1

Affected Products

Alt Linux
Astra Linux
Firefox
Linuxmint
Suse
Ubuntu