CVE-2022-46872 — Out-of-bounds Read in Mozilla Firefox
Severity
8.6HIGHNVD
OSV8.8OSV6.5
EPSS
0.3%
top 45.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 22
Latest updateFeb 6
Description
An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.*This bug only affects Thunderbird for Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NExploitability: 3.9 | Impact: 4.0
Affected Packages9 packages
🔴Vulnerability Details
6OSV▶
CVE-2022-46872: An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages↗2022-12-22
CVEList▶
CVE-2022-46872: An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages↗2022-12-22
GHSA▶
GHSA-w696-j5x3-hhvj: An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages↗2022-12-22
📋Vendor Advisories
8Debian▶
CVE-2022-46872: firefox - An attacker who compromised a content process could have partially escaped the s...↗2022