by Kastro
Paper/Archive/CVE-2022-29917

CVE-2022-29917

Mozilla Thunderbird — Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Fire…

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 64.4.644 × 2012.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR 91.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.

Affected

ProductAffectedFixed inSource
Thunderbirdunspecified – < 91.991.9CNA
Firefox ESRunspecified – < 91.991.9CNA
Firefoxunspecified – < 100100CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refmozilla.org/security/advisories/mfsa2022-16refmozilla.org/security/advisories/mfsa2022-18refmozilla.org/security/advisories/mfsa2022-17refbugzilla.mozilla.org/buglist.cgi?bug_id=1684739%2C1706441%2C1753298%2C1762614%2C1762620%2C1764778