CVE-2022-46881
published 2022-12-22CVE-2022-46881: An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash. *Note*: This advisory was…
PriorityP339high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.72%
49.5th percentile
An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash.
*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 106. This vulnerability affects Firefox < 106, Firefox ESR < 102.6, and Thunderbird < 102.6.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 106.0-1 (sid) | firefox 106.0-1 (sid) |
| debian | firefox-esr | < firefox 106.0-1 (sid) | firefox 106.0-1 (sid) |
| debian | thunderbird | < firefox 106.0-1 (sid) | firefox 106.0-1 (sid) |
| mozilla | firefox | < 106.0 | 106.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= unspecified < 106 | 106 |
| mozilla | firefox_esr | < 102.6 | 102.6 |
| mozilla | firefox_esr | >= unspecified < 102.6 | 102.6 |
| mozilla | thunderbird | < 102.6 | 102.6 |
| mozilla | thunderbird | >= 0 < 1:102.6.0-1~deb11u1 | 1:102.6.0-1~deb11u1 |
| mozilla | thunderbird | >= 0 < 1:102.6.0-1 | 1:102.6.0-1 |
| mozilla | thunderbird | >= 0 < 1:102.6.0-1 | 1:102.6.0-1 |
| mozilla | thunderbird | >= 0 < 1:102.6.0-1 | 1:102.6.0-1 |
| mozilla | thunderbird | >= 0 < 1:102.7.1+build2-0ubuntu0.18.04.1 | 1:102.7.1+build2-0ubuntu0.18.04.1 |
| mozilla | thunderbird | >= 0 < 1:102.7.1+build2-0ubuntu0.20.04.1 | 1:102.7.1+build2-0ubuntu0.20.04.1 |
| mozilla | thunderbird | >= 0 < 1:102.7.1+build2-0ubuntu0.22.04.1 | 1:102.7.1+build2-0ubuntu0.22.04.1 |
| mozilla | thunderbird | >= unspecified < 102.6 | 102.6 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
thunderbird vulnerabilities
osv·2023-02-06·CVSS 6.5
CVE-2022-45403 [MEDIUM] thunderbird vulnerabilities
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2022-45403, CVE-2022-45404,
CVE-2022-45405, CVE-2022-45406, CVE-2022-45408, CVE-2022-45409,
CVE-2022-45410, CVE-2022-45411, CVE-2022-45418, CVE-2022-45420,
CVE-2022-45421, CVE-2022-46878, CVE-2022-46880, CVE-2022-46881,
CVE-2022-46882, CVE-2023-23605)
Armin Ebert discovered that Thunderbird did not properly manage memory
while resolving file symlink. If a user were tricked into opening a
specially crafted weblink, an attacker could pote
OSV
CVE-2022-46881: An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash
osv·2022-12-22·CVSS 8.8
CVE-2022-46881 [HIGH] CVE-2022-46881: An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash
An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash. *Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 106. This vulnerability affects Firefox < 106, Firefox ESR < 102.6, and Thunderbird < 102.6.
GHSA
GHSA-5grf-cv3x-c266: An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash
ghsa_unreviewed·2022-12-22
CVE-2022-46881 [HIGH] CWE-787 GHSA-5grf-cv3x-c266: An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash
An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 106, Firefox ESR < 102.6, and Thunderbird < 102.6.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2023-02-06·CVSS 6.5
CVE-2022-45409 [MEDIUM] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2022-45403, CVE-2022-45404,
CVE-2022-45405, CVE-2022-45406, CVE-2022-45408, CVE-2022-45409,
CVE-2022-45410, CVE-2022-45411, CVE-2022-45418, CVE-2022-45420,
CVE-2022-45421, CVE-2022-46878, CVE-2022-46880, CVE-2022-46881,
CVE-2022-46882, CVE-2023-23605)
Armin Ebert discovered that Thunderbird did not properly manage memory
while resolving file symlink. If a user were tric
Red Hat
Mozilla: Memory corruption in WebGL
vendor_redhat·2022-12-13·CVSS 8.8
CVE-2022-46881 [HIGH] CWE-119 Mozilla: Memory corruption in WebGL
Mozilla: Memory corruption in WebGL
An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash.
*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 106. This vulnerability affects Firefox < 106, Firefox ESR < 102.6, and Thunderbird < 102.6.
The Mozilla Foundation Security Advisory describes this flaw as:
An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Package: firefox (Red Hat Enterprise Linux 6) - Ou
Debian
CVE-2022-46881: firefox - An optimization in WebGL was incorrect in some cases, and could have led to memo...
vendor_debian·2022·CVSS 8.8
CVE-2022-46881 [HIGH] CVE-2022-46881: firefox - An optimization in WebGL was incorrect in some cases, and could have led to memo...
An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash. *Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 106. This vulnerability affects Firefox < 106, Firefox ESR < 102.6, and Thunderbird < 102.6.
Scope: local
sid: resolved (fixed in 106.0-1)
Mozilla
Mozilla Foundation Security Advisory 2022-52: CVE-2022-46881
vendor_mozilla·CVSS 8.8
CVE-2022-46881 [HIGH] Mozilla Foundation Security Advisory 2022-52: CVE-2022-46881
Mozilla Foundation Security Advisory 2022-52
CVE: CVE-2022-46881
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 102.6
Mozilla
Mozilla Foundation Security Advisory 2022-53: CVE-2022-46881
vendor_mozilla·CVSS 8.8
CVE-2022-46881 [HIGH] Mozilla Foundation Security Advisory 2022-53: CVE-2022-46881
Mozilla Foundation Security Advisory 2022-53
CVE: CVE-2022-46881
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 102.6
Mozilla
Mozilla Foundation Security Advisory 2022-44: CVE-2022-46881
vendor_mozilla·CVSS 8.8
CVE-2022-46881 [HIGH] Mozilla Foundation Security Advisory 2022-44: CVE-2022-46881
Mozilla Foundation Security Advisory 2022-44
CVE: CVE-2022-46881
Product: Firefox
Impact: moderate
Fixed in: Firefox 106
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1770930https://security.gentoo.org/glsa/202305-06https://security.gentoo.org/glsa/202305-13https://www.mozilla.org/security/advisories/mfsa2022-44/https://www.mozilla.org/security/advisories/mfsa2022-52/https://www.mozilla.org/security/advisories/mfsa2022-53/https://bugzilla.mozilla.org/show_bug.cgi?id=1770930https://security.gentoo.org/glsa/202305-06https://security.gentoo.org/glsa/202305-13https://www.mozilla.org/security/advisories/mfsa2022-44/https://www.mozilla.org/security/advisories/mfsa2022-52/https://www.mozilla.org/security/advisories/mfsa2022-53/
2022-12-22
Published