PT-2022-5486 · Mozilla+10 · Firefox Esr+12

Atte Kettunen · Published 2022-11-15 · Updated 2024-12-12 · CVE-2022-45405

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 107 Firefox ESR versions prior to 102.5 Thunderbird versions prior to 102.5

Description The issue is related to the use of nsIInputStream interfaces in Firefox, Firefox ESR, and Thunderbird, which could lead to a use-after-free condition and potentially exploitable crash. This could allow a remote attacker to execute arbitrary code.

Recommendations For Firefox versions prior to 107, update to version 107 or later. For Firefox ESR versions prior to 102.5, update to version 102.5 or later. For Thunderbird versions prior to 102.5, update to version 102.5 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2022:8547

ALSA-2022:8554

ALSA-2022:8561

ALSA-2022:8580

ALT-PU-2022-3090

ALT-PU-2022-3097

ALT-PU-2022-3099

ALT-PU-2022-3209

ALT-PU-2022-3270

ALT-PU-2022-3340

ALT-PU-2023-1137

ALT-PU-2023-1138

ALT-PU-2023-4335

ALT-PU-2023-4336

ALT-PU-2023-5754

ALT-PU-2024-3614

BDU:2022-06815

CESA-2022_8547

CESA-2022_8552

CESA-2022_8554

CESA-2022_8555

CVE-2022-45405

DLA-3196-1

DLA-3199-1

DSA-5282-1

DSA-5284-1

MGASA-2022-0427

MGASA-2022-0428

OPENSUSE-SU-2022_4058-1

OPENSUSE-SU-2022_4085-1

OPENSUSE-SU-2024:12518-1

OPENSUSE-SU-2024:12519-1

OPENSUSE-SU-2024:12532-1

OPENSUSE-SU-2024:14572-1

RHSA-2022:8543

RHSA-2022:8544

RHSA-2022:8545

RHSA-2022:8547

RHSA-2022:8548

RHSA-2022:8549

RHSA-2022:8550

RHSA-2022:8552

RHSA-2022:8553

RHSA-2022:8554

RHSA-2022:8555

RHSA-2022:8556

RHSA-2022:8561

RHSA-2022:8580

RHSA-2022:8979

RHSA-2022:8980

RHSA-2022_8547

RHSA-2022_8552

RHSA-2022_8554

RHSA-2022_8555

RHSA-2022_8561

RHSA-2022_8580

RLSA-2022:8547

RLSA-2022:8554

SUSE-SU-2022:4058-1

SUSE-SU-2022:4083-1

SUSE-SU-2022:4085-1

SUSE-SU-2022:4247-1

USN-5726-1

USN-5824-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Firefox

Firefox Esr

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Thunderbird

Ubuntu

References · 2015

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1791314 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2022:4083-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45407 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12532-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-46872 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45405 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-45405 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2022-48 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-40674 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-45405 · Security Note
• https://mozilla.org/security/advisories/mfsa2022-49 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2022-8554.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45412 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-8554.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45418 · Vendor Advisory