PT-2022-3337 · Mozilla+5 · Firefox+5

Ronald Crane

·

Published

2022-06-28

·

Updated

2024-12-12

·

CVE-2022-34480

CVSS v2.0

10

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 102
Description The issue is related to a null pointer dereference. Exploitation of this issue may allow a remote attacker to execute arbitrary code. Within the lg init() function, if several allocations succeed but then one fails, an uninitialized pointer would have been freed despite never being allocated.
Recommendations For versions prior to 102, update to a version that contains a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the lg init() function until a patch is available.

Exploit

Fix

Access of Uninitialized Pointer

NULL Pointer Dereference

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-824CWE-476

Related Identifiers

ALT-PU-2022-2151
ALT-PU-2022-2458
ALT-PU-2022-2929
ALT-PU-2022-2930
ALT-PU-2023-1138
ALT-PU-2023-1139
ALT-PU-2023-4336
ALT-PU-2023-4339
BDU:2022-04085
CVE-2022-34480
OESA-2023-1673
OESA-2023-1674
OPENSUSE-SU-2022_3396-1
OPENSUSE-SU-2024:12184-1
OPENSUSE-SU-2024:14572-1
SUSE-SU-2022:3272-1
SUSE-SU-2022:3273-1
SUSE-SU-2022:3396-1
USN-5504-1
USN-5506-1
USN-5872-1

Affected Products

Alt Linux
Astra Linux
Linuxmint
Firefox
Suse
Ubuntu