Log in Start free

Vulnerability · Published Dec 22, 2022 · Assigned by mozilla

CVE-2022-46874

High 8.8

In plain English

A high-severity code injection in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.0%top 37.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.<br/>*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8firefox102.6.0-1.el8_7.almaALSA-2022:9067
AlmaLinux:9firefox102.6.0-1.el9_1.almaALSA-2022:9065
AlmaLinux:8thunderbird102.6.0-2.el8_7.almaALSA-2022:9074
AlmaLinux:9thunderbird102.6.0-2.el9_1.almaALSA-2022:9080
Alpine:v3.20firefox-esr102.6.0-r0ALPINE-CVE-2022-46874
Alpine:v3.21firefox-esr102.6.0-r0ALPINE-CVE-2022-46874
Alpine:v3.22firefox-esr102.6.0-r0ALPINE-CVE-2022-46874
Alpine:v3.23firefox-esr102.6.0-r0ALPINE-CVE-2022-46874
Debian:12firefox-esr102.6.0esr-1DEBIAN-CVE-2022-46874
Debian:13firefox-esr102.6.0esr-1DEBIAN-CVE-2022-46874
Debian:14firefox-esr102.6.0esr-1DEBIAN-CVE-2022-46874
Debian:12thunderbird1:102.6.0-1DEBIAN-CVE-2022-46874
Debian:13thunderbird1:102.6.0-1DEBIAN-CVE-2022-46874
Debian:14thunderbird1:102.6.0-1DEBIAN-CVE-2022-46874
Rocky Linux:8firefox0:102.6.0-1.el8_7RLSA-2022:9067
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2022-46874
Ubuntu:22.04:LTSmozjs91no fix listedUBUNTU-CVE-2022-46874
Ubuntu:22.04:LTSthunderbird1:102.7.1+build2-0ubuntu0.22.04.1UBUNTU-CVE-2022-46874
Ubuntu:22.04:LTSthunderbird1:102.7.1+build2-0ubuntu0.22.04.1USN-5824-1

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 108
Mozilla Thunderbird unspecified – before 102.6.1unspecified – before 102.6
Mozilla Firefox ESR unspecified – before 102.6

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References