Vulnerability · Published Dec 22, 2022 · Assigned by mozilla
CVE-2022-38472
Medium 6.5
In plain English
A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | firefox | 91.13.0-1.el8_6.alma | ALSA-2022:6175 |
| AlmaLinux:9 | firefox | 91.13.0-1.el9_0.alma | ALSA-2022:6174 |
| AlmaLinux:8 | thunderbird | 91.13.0-1.el8_6.alma | ALSA-2022:6164 |
| AlmaLinux:9 | thunderbird | 91.13.0-1.el9_0.alma | ALSA-2022:6165 |
| Alpine:v3.20 | firefox-esr | 102.2.0-r0 | ALPINE-CVE-2022-38472 |
| Alpine:v3.21 | firefox-esr | 102.2.0-r0 | ALPINE-CVE-2022-38472 |
| Alpine:v3.22 | firefox-esr | 102.2.0-r0 | ALPINE-CVE-2022-38472 |
| Alpine:v3.23 | firefox-esr | 102.2.0-r0 | ALPINE-CVE-2022-38472 |
| Debian:12 | firefox-esr | 102.2.0esr-1 | DEBIAN-CVE-2022-38472 |
| Debian:13 | firefox-esr | 102.2.0esr-1 | DEBIAN-CVE-2022-38472 |
| Debian:14 | firefox-esr | 102.2.0esr-1 | DEBIAN-CVE-2022-38472 |
| Debian:12 | thunderbird | 1:102.2.0-1 | DEBIAN-CVE-2022-38472 |
| Debian:13 | thunderbird | 1:102.2.0-1 | DEBIAN-CVE-2022-38472 |
| Debian:14 | thunderbird | 1:102.2.0-1 | DEBIAN-CVE-2022-38472 |
| Rocky Linux:8 | firefox | 0:91.13.0-1.el8_6 | RLSA-2022:6175 |
| Rocky Linux:8 | thunderbird | 0:91.13.0-1.el8_6 | RLSA-2022:6164 |
| Ubuntu:22.04:LTS | thunderbird | 1:102.2.2+build1-0ubuntu0.22.04.1 | UBUNTU-CVE-2022-38472 |
| Ubuntu:22.04:LTS | thunderbird | 1:102.2.2+build1-0ubuntu0.22.04.1 | USN-5663-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Thunderbird | unspecified – before 102.2unspecified – before 91.13 |
| Mozilla | Firefox ESR | unspecified – before 91.13unspecified – before 102.2 |
| Mozilla | Firefox | unspecified – before 104 |
Weakness: CWE-346 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References
- https://www.mozilla.org/security/advisories/mfsa2022-35/
- https://www.mozilla.org/security/advisories/mfsa2022-33/
- https://www.mozilla.org/security/advisories/mfsa2022-37/
- https://www.mozilla.org/security/advisories/mfsa2022-36/
- https://www.mozilla.org/security/advisories/mfsa2022-34/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1769155