PT-2022-6964 · Mozilla+3 · Firefox+3

Timothy Nikkel · Published 2022-10-18 · Updated 2024-03-13 · CVE-2022-46884

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 106

Description A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an inopportune time. This could have led to memory corruption or a potentially exploitable crash.

Recommendations For Firefox versions prior to 106, update to Firefox 106 or later to resolve the issue. As a temporary workaround, consider avoiding the use of SVG images in Firefox until the update is applied.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2023-5754

ALT-PU-2023-6436

ALT-PU-2024-3614

BDU:2023-05886

CVE-2022-46884

Affected Products

Alt Linux

Astra Linux

Firefox

Red Os

References · 23

• 🔥 https://github.com/mistymntncop/CVE-2023-4863 · Exploit
• 🔥 https://github.com/LiveOverflow/webp-CVE-2023-4863 · Exploit
• 🔥 https://github.com/UT-Security/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/wrv/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/bbaranoff/CVE-2023-4863 · Exploit
• https://cve.org/CVERecord?id=CVE-2022-46884 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2022-44/#CVE-2022-46884 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-46884 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2022-44 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-46884 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-46884 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1786818 · Vendor Advisory