Vulnerability CVE-2022-46880: Information

Description

A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 105. This vulnerability affects Firefox ESR < 102.6, Firefox < 105, and Thunderbird < 102.6.

Severity: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2022-46880
Published: Dec. 22, 2022
Modified: May 3, 2023
Error type identifier: CWE-416

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus105.0-alt1126.0.1-alt1ALT-PU-2022-2653-1307177Fixed
firefoxp10105.0.1-alt0.p10.1118.0.2-alt0.p10.1ALT-PU-2022-2930-1307737Fixed
firefoxp9105.0.1-alt0.c9.1105.0.1-alt0.c9.1ALT-PU-2023-4339-1319683Fixed
firefoxc10f1105.0.1-alt0.p10.1112.0.2-alt0.p10.1ALT-PU-2022-2930-1307737Fixed
firefoxc9f2105.0.1-alt0.c9.1105.0.1-alt0.c9.1ALT-PU-2023-1139-1309126Fixed
firefoxp11105.0-alt1126.0.1-alt1ALT-PU-2022-2653-1307177Fixed
firefox-esrsisyphus102.6.0-alt1115.11.0-alt1ALT-PU-2022-3341-1311756Fixed
firefox-esrp10102.6.0-alt1115.11.0-alt1ALT-PU-2022-3401-1311776Fixed
firefox-esrp9102.6.0-alt0.c9.1102.11.0-alt0.c9.1ALT-PU-2023-4336-1319683Fixed
firefox-esrc10f1115.8.0-alt0.c10.1115.9.1-alt0.c10.1ALT-PU-2024-3614-2340631Fixed
firefox-esrc9f2102.6.0-alt0.c9.1102.12.0-alt0.c9.1ALT-PU-2023-1138-1309126Fixed
firefox-esrp11102.6.0-alt1115.11.0-alt1ALT-PU-2022-3341-1311756Fixed
thunderbirdsisyphus102.6.0-alt1115.9.0-alt1ALT-PU-2022-3354-1311856Fixed
thunderbirdp10102.6.0-alt1115.9.0-alt1ALT-PU-2022-3407-1311857Fixed
thunderbirdp9102.7.1-alt1102.11.0-alt0.c9.1ALT-PU-2023-4335-1319683Fixed
thunderbirdc10f1102.6.0-alt1115.9.0-alt0.c10.1ALT-PU-2022-3407-1311857Fixed
thunderbirdc9f2102.6.1-alt1102.11.0-alt0.c9.1ALT-PU-2023-1137-1309126Fixed
thunderbirdp11102.6.0-alt1115.9.0-alt1ALT-PU-2022-3354-1311856Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://www.mozilla.org/security/advisories/mfsa2022-53/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-52/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-40/
  • Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1749292
  • Issue Tracking
  • Permissions Required
GLSA-202305-06
    GLSA-202305-13

        1. Configuration 1

          cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
          End excliding
          105.0
          cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
          End excliding
          102.6
          cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
          End excliding
          102.6
      VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
      Version: v24.5.3
      Back to top