PT-2022-3947 · Mozilla+4 · Firefox+4

Published 2022-07-26 · Updated 2024-12-12 · CVE-2022-36320

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 103

Description The issue is caused by a buffer overflow in memory, potentially allowing a remote attacker to execute arbitrary code using a specially crafted website. Memory safety bugs have been reported, showing evidence of memory corruption, which could be exploited with sufficient effort.

Recommendations For versions prior to 103, update to version 103 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable websites until the update is applied.

Exploit

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

ALT-PU-2022-2306

ALT-PU-2022-2930

ALT-PU-2023-1139

ALT-PU-2023-4339

ALT-PU-2023-5754

ALT-PU-2023-6436

ALT-PU-2024-3614

BDU:2022-04776

CVE-2022-36320

OPENSUSE-SU-2024:12227-1

OPENSUSE-SU-2024:14572-1

USN-5536-1

Affected Products

Alt Linux

Astra Linux

Firefox

Linuxmint

Ubuntu

References · 1895

• 🔥 https://github.com/mistymntncop/CVE-2023-4863 · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-1802 · Exploit
• 🔥 https://github.com/0vercl0k/CVE-2022-28281 · Exploit
• 🔥 https://github.com/LiveOverflow/webp-CVE-2023-4863 · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-26485 · Exploit
• 🔥 https://github.com/wrv/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/UT-Security/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/bbaranoff/CVE-2023-4863 · Exploit
• 🔥❌ https://github.com/MagicPwnrin/CVE-2022-28282 · Exploit, Deleted
• 🔥❌ https://github.com/Pwnrin/CVE-2022-28282 · Exploit, Deleted
• https://mozilla.org/security/advisories/mfsa2022-28 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36320 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-36318 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2022-30 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-36319 · Vendor Advisory