CVE-2022-46880
published 2022-12-22CVE-2022-46880: A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.*Note*: This advisory was added on December 13th…
PriorityP430medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.65%
46.7th percentile
A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 105. This vulnerability affects Firefox ESR < 102.6, Firefox < 105, and Thunderbird < 102.6.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 105.0-1 (sid) | firefox 105.0-1 (sid) |
| debian | firefox-esr | < firefox 105.0-1 (sid) | firefox 105.0-1 (sid) |
| debian | thunderbird | < firefox 105.0-1 (sid) | firefox 105.0-1 (sid) |
| mozilla | firefox | < 105.0 | 105.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= unspecified < 105 | 105 |
| mozilla | firefox_esr | < 102.6 | 102.6 |
| mozilla | firefox_esr | >= unspecified < 102.6 | 102.6 |
| mozilla | thunderbird | < 102.6 | 102.6 |
| mozilla | thunderbird | >= 0 < 1:102.6.0-1~deb11u1 | 1:102.6.0-1~deb11u1 |
| mozilla | thunderbird | >= 0 < 1:102.6.0-1 | 1:102.6.0-1 |
| mozilla | thunderbird | >= 0 < 1:102.6.0-1 | 1:102.6.0-1 |
| mozilla | thunderbird | >= 0 < 1:102.6.0-1 | 1:102.6.0-1 |
| mozilla | thunderbird | >= 0 < 1:102.7.1+build2-0ubuntu0.18.04.1 | 1:102.7.1+build2-0ubuntu0.18.04.1 |
| mozilla | thunderbird | >= 0 < 1:102.7.1+build2-0ubuntu0.20.04.1 | 1:102.7.1+build2-0ubuntu0.20.04.1 |
| mozilla | thunderbird | >= 0 < 1:102.7.1+build2-0ubuntu0.22.04.1 | 1:102.7.1+build2-0ubuntu0.22.04.1 |
| mozilla | thunderbird | >= unspecified < 102.6 | 102.6 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
thunderbird vulnerabilities
osv·2023-02-06·CVSS 6.5
CVE-2022-45403 [MEDIUM] thunderbird vulnerabilities
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2022-45403, CVE-2022-45404,
CVE-2022-45405, CVE-2022-45406, CVE-2022-45408, CVE-2022-45409,
CVE-2022-45410, CVE-2022-45411, CVE-2022-45418, CVE-2022-45420,
CVE-2022-45421, CVE-2022-46878, CVE-2022-46880, CVE-2022-46881,
CVE-2022-46882, CVE-2023-23605)
Armin Ebert discovered that Thunderbird did not properly manage memory
while resolving file symlink. If a user were tricked into opening a
specially crafted weblink, an attacker could pote
OSV
CVE-2022-46880: A missing check related to tex units could have led to a use-after-free and potentially exploitable crash
osv·2022-12-22·CVSS 6.5
CVE-2022-46880 [MEDIUM] CVE-2022-46880: A missing check related to tex units could have led to a use-after-free and potentially exploitable crash
A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 105. This vulnerability affects Firefox ESR < 102.6, Firefox < 105, and Thunderbird < 102.6.
GHSA
GHSA-j5r5-jmr3-48c5: A missing check related to tex units could have led to a use-after-free and potentially exploitable crash
ghsa_unreviewed·2022-12-22
CVE-2022-46880 [MEDIUM] CWE-416 GHSA-j5r5-jmr3-48c5: A missing check related to tex units could have led to a use-after-free and potentially exploitable crash
A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 105. This vulnerability affects Firefox ESR < 102.6, Firefox < 105, and Thunderbird < 102.6.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2023-02-06·CVSS 6.5
CVE-2022-45409 [MEDIUM] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2022-45403, CVE-2022-45404,
CVE-2022-45405, CVE-2022-45406, CVE-2022-45408, CVE-2022-45409,
CVE-2022-45410, CVE-2022-45411, CVE-2022-45418, CVE-2022-45420,
CVE-2022-45421, CVE-2022-46878, CVE-2022-46880, CVE-2022-46881,
CVE-2022-46882, CVE-2023-23605)
Armin Ebert discovered that Thunderbird did not properly manage memory
while resolving file symlink. If a user were tric
Red Hat
Mozilla: Use-after-free in WebGL
vendor_redhat·2022-12-13·CVSS 6.5
CVE-2022-46880 [MEDIUM] CWE-416 Mozilla: Use-after-free in WebGL
Mozilla: Use-after-free in WebGL
A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 105. This vulnerability affects Firefox ESR < 102.6, Firefox < 105, and Thunderbird < 102.6.
The Mozilla Foundation Security Advisory describes this flaw as: A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.
Package: firefox (Red Hat Enterprise Linux 6) - Out of support scope
Package: thunderbird (Red Hat Enterprise Linux 6) - Out of support scope
Debian
CVE-2022-46880: firefox - A missing check related to tex units could have led to a use-after-free and pote...
vendor_debian·2022·CVSS 6.5
CVE-2022-46880 [MEDIUM] CVE-2022-46880: firefox - A missing check related to tex units could have led to a use-after-free and pote...
A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 105. This vulnerability affects Firefox ESR < 102.6, Firefox < 105, and Thunderbird < 102.6.
Scope: local
sid: resolved (fixed in 105.0-1)
Mozilla
Mozilla Foundation Security Advisory 2022-52: CVE-2022-46880
vendor_mozilla·CVSS 6.5
CVE-2022-46880 [MEDIUM] Mozilla Foundation Security Advisory 2022-52: CVE-2022-46880
Mozilla Foundation Security Advisory 2022-52
CVE: CVE-2022-46880
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 102.6
Mozilla
Mozilla Foundation Security Advisory 2022-40: CVE-2022-46880
vendor_mozilla·CVSS 6.5
CVE-2022-46880 [MEDIUM] Mozilla Foundation Security Advisory 2022-40: CVE-2022-46880
Mozilla Foundation Security Advisory 2022-40
CVE: CVE-2022-46880
Product: Firefox
Impact: high
Fixed in: Firefox 105
Mozilla
Mozilla Foundation Security Advisory 2022-53: CVE-2022-46880
vendor_mozilla·CVSS 6.5
CVE-2022-46880 [MEDIUM] Mozilla Foundation Security Advisory 2022-53: CVE-2022-46880
Mozilla Foundation Security Advisory 2022-53
CVE: CVE-2022-46880
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 102.6
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1749292https://security.gentoo.org/glsa/202305-06https://security.gentoo.org/glsa/202305-13https://www.mozilla.org/security/advisories/mfsa2022-40/https://www.mozilla.org/security/advisories/mfsa2022-52/https://www.mozilla.org/security/advisories/mfsa2022-53/https://bugzilla.mozilla.org/show_bug.cgi?id=1749292https://security.gentoo.org/glsa/202305-06https://security.gentoo.org/glsa/202305-13https://www.mozilla.org/security/advisories/mfsa2022-40/https://www.mozilla.org/security/advisories/mfsa2022-52/https://www.mozilla.org/security/advisories/mfsa2022-53/
2022-12-22
Published