Vulnerability · Published Dec 22, 2022 · Assigned by mozilla
CVE-2022-28284
High 8.8
In plain English
A high-severity security flaw in Firefox from Mozilla. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SVG's <code><use></code> element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with theirs. This vulnerability affects Firefox < 99.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | firefox | 99.0-r0 | ALPINE-CVE-2022-28284 |
| Alpine:v3.21 | firefox | 99.0-r0 | ALPINE-CVE-2022-28284 |
| Alpine:v3.22 | firefox | 99.0-r0 | ALPINE-CVE-2022-28284 |
| Alpine:v3.23 | firefox | 99.0-r0 | ALPINE-CVE-2022-28284 |
| Alpine:v3.21 | librewolf | 99.0-r0 | ALPINE-CVE-2022-28284 |
| Alpine:v3.22 | librewolf | 99.0-r0 | ALPINE-CVE-2022-28284 |
| Alpine:v3.23 | librewolf | 99.0-r0 | ALPINE-CVE-2022-28284 |
| Alpine:v3.24 | librewolf | 99.0-r0 | ALPINE-CVE-2022-28284 |
| Ubuntu:22.04:LTS | firefox | 1:1snap1-0ubuntu1 | UBUNTU-CVE-2022-28284 |
Affected products (as reported)
Weakness: CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H