PT-2022-7525 · Mozilla+4 · Firefox+4

Armin Ebert · Published 2022-10-01 · Updated 2025-04-18 · CVE-2022-45407

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 107

Description The issue is related to the use of the FontFace() function on a background worker, which could lead to a use-after-free condition and result in a potentially exploitable crash. This condition occurs when memory is accessed after it has been freed, potentially allowing a remote attacker to cause a denial of service.

Recommendations For versions prior to 107, update to version 107 or later to resolve the issue. As a temporary workaround, consider restricting the use of the FontFace() function on background workers until a patch is applied.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2022-3090

ALT-PU-2022-3270

ALT-PU-2023-5754

ALT-PU-2023-6436

ALT-PU-2024-3614

BDU:2024-06951

CVE-2022-45407

OESA-2025-1422

OESA-2025-1423

OPENSUSE-SU-2024:12518-1

OPENSUSE-SU-2024:14572-1

USN-5726-1

Affected Products

Alt Linux

Astra Linux

Firefox

Linuxmint

Ubuntu

References · 1911

• 🔥 https://github.com/mistymntncop/CVE-2023-4863 · Exploit
• 🔥 https://github.com/LiveOverflow/webp-CVE-2023-4863 · Exploit
• 🔥 https://github.com/wrv/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/UT-Security/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/bbaranoff/CVE-2023-4863 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-45407 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2022-47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45406 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45413 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45409 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45407 · Security Note
• https://ubuntu.com/security/CVE-2022-45419 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45415 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45415 · Security Note