Vulnerability · Published Dec 22, 2022 · Assigned by mozilla
CVE-2022-26386
Medium 6.5
In plain English
A medium-severity security flaw in Firefox ESR from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they could be affected by other local users. This behavior was reverted to the original, user-specific directory. <br>*This bug only affects Firefox for macOS and Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.7 and Thunderbird < 91.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | firefox | 91.7.0-3.el8_5.alma | ALSA-2022:0818 |
| AlmaLinux:8 | thunderbird | 91.7.0-2.el8_5.alma | ALSA-2022:0845 |
| AlmaLinux:8 | thunderbird | 91.7.0-2.el8_5.alma.plus | ALSA-2022:0845 |
| Alpine:v3.20 | firefox-esr | 91.7.0-r0 | ALPINE-CVE-2022-26386 |
| Alpine:v3.21 | firefox-esr | 91.7.0-r0 | ALPINE-CVE-2022-26386 |
| Alpine:v3.22 | firefox-esr | 91.7.0-r0 | ALPINE-CVE-2022-26386 |
| Alpine:v3.23 | firefox-esr | 91.7.0-r0 | ALPINE-CVE-2022-26386 |
| Alpine:v3.20 | thunderbird | 91.7.0-r0 | ALPINE-CVE-2022-26386 |
| Alpine:v3.21 | thunderbird | 91.7.0-r0 | ALPINE-CVE-2022-26386 |
| Alpine:v3.22 | thunderbird | 91.7.0-r0 | ALPINE-CVE-2022-26386 |
| Alpine:v3.23 | thunderbird | 91.7.0-r0 | ALPINE-CVE-2022-26386 |
| Debian:12 | firefox-esr | 91.7.0esr-1 | DEBIAN-CVE-2022-26386 |
| Debian:13 | firefox-esr | 91.7.0esr-1 | DEBIAN-CVE-2022-26386 |
| Debian:14 | firefox-esr | 91.7.0esr-1 | DEBIAN-CVE-2022-26386 |
| Debian:12 | thunderbird | 1:91.7.0-1 | DEBIAN-CVE-2022-26386 |
| Debian:13 | thunderbird | 1:91.7.0-1 | DEBIAN-CVE-2022-26386 |
| Debian:14 | thunderbird | 1:91.7.0-1 | DEBIAN-CVE-2022-26386 |
| Rocky Linux:8 | firefox | 0:91.7.0-3.el8_5 | RLSA-2022:0818 |
| Rocky Linux:8 | thunderbird | 0:91.7.0-2.el8_5 | RLSA-2022:0845 |
| Ubuntu:22.04:LTS | thunderbird | 1:91.7.0+build2-0ubuntu1 | UBUNTU-CVE-2022-26386 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox ESR | unspecified – before 91.7 |
| Mozilla | Thunderbird | unspecified – before 91.7 |
Weakness: CWE-377 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N