Ubuntu.comUB:CVE-2022-40962CVE-2022-40962
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
0.002 Low
EPSS
Percentile
56.7%
Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas
Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs present
in Firefox 104 and Firefox ESR 102.2. Some of these bugs showed evidence of
memory corruption and we presume that with enough effort some of these
could have been exploited to run arbitrary code. This vulnerability affects
Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.
Notes
| Author | Note |
|---|---|
| tyhicks | mozjs contains a copy of the SpiderMonkey JavaScript engine |
| mdeslaur | starting with Ubuntu 22.04, the firefox package is just a script that installs the Firefox snap |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | firefox | < 105.0+build2-0ubuntu0.18.04.1 | UNKNOWN |
| ubuntu | 20.04 | noarch | firefox | < 105.0+build2-0ubuntu0.20.04.1 | UNKNOWN |
| ubuntu | 18.04 | noarch | mozjs38 | < any | UNKNOWN |
| ubuntu | 18.04 | noarch | mozjs52 | < any | UNKNOWN |
| ubuntu | 20.04 | noarch | mozjs52 | < any | UNKNOWN |
| ubuntu | 20.04 | noarch | mozjs68 | < any | UNKNOWN |
| ubuntu | 22.04 | noarch | mozjs78 | < any | UNKNOWN |
| ubuntu | 22.04 | noarch | mozjs91 | < any | UNKNOWN |
| ubuntu | 18.04 | noarch | thunderbird | < 1:102.4.2+build2-0ubuntu0.18.04.1 | UNKNOWN |
| ubuntu | 20.04 | noarch | thunderbird | < 1:102.4.2+build2-0ubuntu0.20.04.1 | UNKNOWN |
References
launchpad.net/bugs/cve/CVE-2022-40962
nvd.nist.gov/vuln/detail/CVE-2022-40962
security-tracker.debian.org/tracker/CVE-2022-40962
ubuntu.com/security/notices/USN-5649-1
ubuntu.com/security/notices/USN-5724-1
www.cve.org/CVERecord?id=CVE-2022-40962
www.mozilla.org/en-US/security/advisories/mfsa2022-40/#CVE-2022-40962
www.mozilla.org/en-US/security/advisories/mfsa2022-41/#CVE-2022-40962
www.mozilla.org/en-US/security/advisories/mfsa2022-42/#CVE-2022-40962
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
0.002 Low
EPSS
Percentile
56.7%