PT-2022-4928 · Mozilla+4 · Thunderbird+6

Hiroshige Hayashizaki · Published 2022-07-26 · Updated 2025-03-14 · CVE-2022-36315

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 103 Firefox ESR (affected versions not specified) Thunderbird (affected versions not specified)

Description The issue is related to errors in resource management when loading a script with Subresource Integrity. Attackers with injection capabilities could reuse previously cached entries with incorrect integrity metadata, potentially impacting the confidentiality and integrity of protected information.

Recommendations For Firefox versions prior to 103, update to version 103 or later to resolve the issue. For Firefox ESR, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Thunderbird, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

CWE-399

Related Identifiers

ALT-PU-2022-2306

ALT-PU-2022-2930

ALT-PU-2023-1139

ALT-PU-2023-4339

ALT-PU-2023-5754

ALT-PU-2023-6436

ALT-PU-2024-3614

BDU:2022-06109

CVE-2022-36315

OESA-2025-1265

OESA-2025-1268

OPENSUSE-SU-2024:12227-1

OPENSUSE-SU-2024:14572-1

USN-5536-1

Affected Products

Alt Linux

Astra Linux

Firefox

Firefox Esr

Linuxmint

Thunderbird

Ubuntu

References · 2084

• 🔥 https://github.com/mistymntncop/CVE-2023-4863 · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-1802 · Exploit
• 🔥 https://github.com/0vercl0k/CVE-2022-28281 · Exploit
• 🔥 https://github.com/LiveOverflow/webp-CVE-2023-4863 · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-26485 · Exploit
• 🔥 https://github.com/wrv/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/UT-Security/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/bbaranoff/CVE-2023-4863 · Exploit
• 🔥❌ https://github.com/MagicPwnrin/CVE-2022-28282 · Exploit, Deleted
• 🔥❌ https://github.com/Pwnrin/CVE-2022-28282 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2022-36315 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-4367 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-9394 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-6613 · Security Note
• https://mozilla.org/security/advisories/mfsa2022-28 · Vendor Advisory