CVE-2022-22756
published 2022-12-22CVE-2022-22756: If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script…
PriorityP347high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.93%
56.0th percentile
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 97.0-1 (sid) | firefox 97.0-1 (sid) |
| debian | firefox-esr | < firefox 97.0-1 (sid) | firefox 97.0-1 (sid) |
| debian | thunderbird | < firefox 97.0-1 (sid) | firefox 97.0-1 (sid) |
| mozilla | firefox | < 97.0 | 97.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 97.0+build2-0ubuntu0.18.04.1 | 97.0+build2-0ubuntu0.18.04.1 |
| mozilla | firefox | >= 0 < 97.0+build2-0ubuntu0.20.04.1 | 97.0+build2-0ubuntu0.20.04.1 |
| mozilla | firefox | >= unspecified < 97 | 97 |
| mozilla | firefox_esr | < 91.6 | 91.6 |
| mozilla | firefox_esr | >= unspecified < 91.6 | 91.6 |
| mozilla | thunderbird | < 91.6 | 91.6 |
| mozilla | thunderbird | >= 0 < 1:91.6.0-1~deb11u1 | 1:91.6.0-1~deb11u1 |
| mozilla | thunderbird | >= 0 < 1:91.6.0-1 | 1:91.6.0-1 |
| mozilla | thunderbird | >= 0 < 1:91.6.0-1 | 1:91.6.0-1 |
| mozilla | thunderbird | >= 0 < 1:91.6.0-1 | 1:91.6.0-1 |
| mozilla | thunderbird | >= 0 < 1:91.7.0+build2-0ubuntu0.18.04.1 | 1:91.7.0+build2-0ubuntu0.18.04.1 |
| mozilla | thunderbird | >= 0 < 1:91.7.0+build2-0ubuntu0.20.04.1 | 1:91.7.0+build2-0ubuntu0.20.04.1 |
| mozilla | thunderbird | >= unspecified < 91.6 | 91.6 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Mozilla Firefox up to 96 Remote Code Execution (Bug 1317873 / EUVD-2022-27899)
vuldb·2026-04-29·CVSS 8.8
CVE-2022-22756 [HIGH] Mozilla Firefox up to 96 Remote Code Execution (Bug 1317873 / EUVD-2022-27899)
A vulnerability was found in Mozilla Firefox up to 96. It has been rated as critical. The affected element is an unknown function. Performing a manipulation results in Remote Code Execution.
This vulnerability was named CVE-2022-22756. The attack may be initiated remotely. There is no available exploit.
Upgrading the affected component is advised.
VulDB
Mozilla Thunderbird up to 91.5 Remote Code Execution (Bug 1317873 / EUVD-2022-27899)
vuldb·2026-04-29·CVSS 8.8
CVE-2022-22756 [HIGH] Mozilla Thunderbird up to 91.5 Remote Code Execution (Bug 1317873 / EUVD-2022-27899)
A vulnerability was found in Mozilla Thunderbird up to 91.5 and classified as critical. The affected element is an unknown function. Such manipulation leads to Remote Code Execution.
This vulnerability is traded as CVE-2022-22756. The attack may be launched remotely. There is no exploit available.
It is suggested to upgrade the affected component.
OSV
CVE-2022-22756: If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable sc
osv·2022-12-22·CVSS 8.8
CVE-2022-22756 [HIGH] CVE-2022-22756: If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable sc
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
GHSA
GHSA-34mj-396j-93pr: If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable sc
ghsa_unreviewed·2022-12-22
CVE-2022-22756 [HIGH] CWE-94 GHSA-34mj-396j-93pr: If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable sc
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
OSV
thunderbird vulnerabilities
osv·2022-03-23·CVSS 8.8
CVE-2022-22759 [HIGH] thunderbird vulnerabilities
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
bypass security restrictions, obtain sensitive information, cause
undefined behaviour, spoof the browser UI, or execute arbitrary code.
(CVE-2022-22759, CVE-2022-22760, CVE-2022-22761, CVE-2022-22763,
CVE-2022-22764, CVE-2022-26381, CVE-2022-26383, CVE-2022-26384)
It was discovered that extensions of a particular type could auto-update
themselves and bypass the prompt that requests permissions. If a user
were tricked into installing a specially crafted extension, an attacker
could potentially exploit this to bypass security restrictions.
(CVE-202
OSV
firefox vulnerabilities
osv·2022-02-14·CVSS 8.8
CVE-2022-0511 [HIGH] firefox vulnerabilities
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, bypass security
restrictions, obtain sensitive information, or execute arbitrary code.
(CVE-2022-0511, CVE-2022-22755, CVE-2022-22759, CVE-2022-22760,
CVE-2022-22761, CVE-2022-22764)
It was discovered that extensions of a particular type could auto-update
themselves and bypass the prompt that requests permissions. If a user
were tricked into installing a specially crafted extension, an attacker
could potentially exploit this to bypass security restrictions.
(CVE-2022-22754)
It was discovered that dragging and dropping an image into a folder could
result in it being marked as
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2022-03-23·CVSS 8.8
CVE-2022-26386 [HIGH] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
bypass security restrictions, obtain sensitive information, cause
undefined behaviour, spoof the browser UI, or execute arbitrary code.
(CVE-2022-22759, CVE-2022-22760, CVE-2022-22761, CVE-2022-22763,
CVE-2022-22764, CVE-2022-26381, CVE-2022-26383, CVE-2022-26384)
It was discovered that extensions of a particular type could auto-update
themselves and bypass the prompt that requests permissions. If a user
were tricked into installing a specially crafted extension, an attacker
coul
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2022-02-14·CVSS 8.8
CVE-2022-22754 [HIGH] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, bypass security
restrictions, obtain sensitive information, or execute arbitrary code.
(CVE-2022-0511, CVE-2022-22755, CVE-2022-22759, CVE-2022-22760,
CVE-2022-22761, CVE-2022-22764)
It was discovered that extensions of a particular type could auto-update
themselves and bypass the prompt that requests permissions. If a user
were tricked into installing a specially crafted extension, an attacker
could potentially exploit this to bypass security restrictions.
(CVE-202
Red Hat
Mozilla: Drag and dropping an image could have resulted in the dropped object being an executable
vendor_redhat·2022-02-08·CVSS 8.8
CVE-2022-22756 [HIGH] CWE-1021 Mozilla: Drag and dropping an image could have resulted in the dropped object being an executable
Mozilla: Drag and dropping an image could have resulted in the dropped object being an executable
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
The Mozilla Foundation Security Advisory describes this flaw as:
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script, which would have run arbitrary code after the user clicked it.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation S
Debian
CVE-2022-22756: firefox - If a user was convinced to drag and drop an image to their desktop or other fold...
vendor_debian·2022·CVSS 8.8
CVE-2022-22756 [HIGH] CVE-2022-22756: firefox - If a user was convinced to drag and drop an image to their desktop or other fold...
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Scope: local
sid: resolved (fixed in 97.0-1)
Mozilla
Mozilla Foundation Security Advisory 2022-06: CVE-2022-22756
vendor_mozilla·CVSS 8.8
CVE-2022-22756 [HIGH] Mozilla Foundation Security Advisory 2022-06: CVE-2022-22756
Mozilla Foundation Security Advisory 2022-06
CVE: CVE-2022-22756
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 91.6
Mozilla
Mozilla Foundation Security Advisory 2022-05: CVE-2022-22756
vendor_mozilla·CVSS 8.8
CVE-2022-22756 [HIGH] Mozilla Foundation Security Advisory 2022-05: CVE-2022-22756
Mozilla Foundation Security Advisory 2022-05
CVE: CVE-2022-22756
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 91.6
Mozilla
Mozilla Foundation Security Advisory 2022-04: CVE-2022-22756
vendor_mozilla·CVSS 8.8
CVE-2022-22756 [HIGH] Mozilla Foundation Security Advisory 2022-04: CVE-2022-22756
Mozilla Foundation Security Advisory 2022-04
CVE: CVE-2022-22756
Product: Firefox
Impact: high
Fixed in: Firefox 97
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1317873https://www.mozilla.org/security/advisories/mfsa2022-04/https://www.mozilla.org/security/advisories/mfsa2022-05/https://www.mozilla.org/security/advisories/mfsa2022-06/https://bugzilla.mozilla.org/show_bug.cgi?id=1317873https://www.mozilla.org/security/advisories/mfsa2022-04/https://www.mozilla.org/security/advisories/mfsa2022-05/https://www.mozilla.org/security/advisories/mfsa2022-06/
2022-12-22
Published