Vulnerability CVE-2022-22753: Information

Description

A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.

Severity: HIGH (7.1) Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2022-22753
Published: Dec. 22, 2022
Modified: Dec. 30, 2022
Error type identifier: CWE-367

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus97.0-alt1127.0-alt1ALT-PU-2022-1230-1295113Fixed
firefoxp10105.0.1-alt0.p10.1118.0.2-alt0.p10.1ALT-PU-2022-2930-1307737Fixed
firefoxp9105.0.1-alt0.c9.1105.0.1-alt0.c9.1ALT-PU-2023-4339-1319683Fixed
firefoxc10f1105.0.1-alt0.p10.1112.0.2-alt0.p10.1ALT-PU-2022-2930-1307737Fixed
firefoxc9f2105.0.1-alt0.c9.1105.0.1-alt0.c9.1ALT-PU-2023-1139-1309126Fixed
firefoxp1197.0-alt1126.0.1-alt1ALT-PU-2022-1230-1295113Fixed
firefox-esrsisyphus91.6.0-alt1115.11.0-alt1ALT-PU-2022-1229-1295121Fixed
firefox-esrp1091.6.0-alt1115.11.0-alt1ALT-PU-2022-1312-1295122Fixed
firefox-esrp991.7.0-alt0.p9.1102.11.0-alt0.c9.1ALT-PU-2022-1781-1288073Fixed
firefox-esrc10f191.6.0-alt1115.9.1-alt0.c10.1ALT-PU-2022-1312-1295122Fixed
firefox-esrc9f291.6.0-alt0.c9.1102.12.0-alt0.c9.1ALT-PU-2022-1313-1295320Fixed
firefox-esrp1191.6.0-alt1115.11.0-alt1ALT-PU-2022-1229-1295121Fixed
thunderbirdsisyphus91.6.0-alt1115.9.0-alt1ALT-PU-2022-1268-1295259Fixed
thunderbirdp1091.6.0-alt1115.9.0-alt1ALT-PU-2022-1316-1295262Fixed
thunderbirdp991.6.0-alt0.p9.1102.11.0-alt0.c9.1ALT-PU-2022-1783-1288073Fixed
thunderbirdc10f191.6.0-alt1115.9.0-alt0.c10.1ALT-PU-2022-1316-1295262Fixed
thunderbirdc9f291.6.0-alt0.c9.1102.11.0-alt0.c9.1ALT-PU-2022-1311-1295333Fixed
thunderbirdp1191.6.0-alt1115.9.0-alt1ALT-PU-2022-1268-1295259Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1732435
  • Exploit
  • Issue Tracking
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-06/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-05/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-04/
  • Vendor Advisory

    1. Configuration 1

      cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
      cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
      cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top