by Kastro
Paper/Archive/CVE-2022-31747

CVE-2022-31747

Mozilla Thunderbird — Mozilla developers Andrew McCreight, Nicolas B.

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.8.608 × 2012.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.

Affected

ProductAffectedFixed inSource
Thunderbirdunspecified – < 91.1091.10CNA
Firefoxunspecified – < 101101CNA
Firefox ESRunspecified – < 91.1091.10CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refmozilla.org/security/advisories/mfsa2022-20refmozilla.org/security/advisories/mfsa2022-22refmozilla.org/security/advisories/mfsa2022-21refbugzilla.mozilla.org/buglist.cgi?bug_id=1760765%2C1765610%2C1766283%2C1767365%2C1768559%2C1768734