CVE-2022-1097: Use After Free
<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.
Other sources
NSSToken objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2022-1097?
CVE-2022-1097 is a vulnerability that allows for use-after-free and potentially exploitable crashes in Thunderbird and Firefox.
Which software is affected by CVE-2022-1097?
Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8 are affected by CVE-2022-1097.
What is the severity of CVE-2022-1097?
CVE-2022-1097 has a severity rating of 6.5 (high).
How can I fix CVE-2022-1097?
To fix CVE-2022-1097, it is recommended to update Thunderbird to version 91.8 or later, Firefox to version 99 or later, and Firefox ESR to version 91.8 or later.
Where can I find more information about CVE-2022-1097?
You can find more information about CVE-2022-1097 in the following references: [Mozilla Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1745667), [Mozilla Security Advisory (mfsa2022-14)](https://www.mozilla.org/en-US/security/advisories/mfsa2022-14/), [Mozilla Security Advisory (mfsa2022-13)](https://www.mozilla.org/en-US/security/advisories/mfsa2022-13/#CVE-2022-1097).