CVE-2022-1802: High severity Mozilla Firefox vulnerability
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 100.0.2 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 91.9.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 91.9.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 100.0.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 91.9.1 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 100.0.2-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 91.9.1-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 100.0.2-r0 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 91.9.1-r0 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.9.1esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:91.10.0-1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2022-1802?
CVE-2022-1802 is a vulnerability that allows an attacker to execute malicious JavaScript code in a privileged context by corrupting the methods of an Array object in JavaScript through prototype pollution.
Which software is affected by CVE-2022-1802?
Mozilla Firefox ESR versions prior to 91.9.1, Mozilla Firefox versions prior to 100.0.2, Mozilla Thunderbird versions prior to 91.9.1, and Mozilla Firefox for Android versions prior to 100.3 are affected.
What is the severity of CVE-2022-1802?
CVE-2022-1802 has a severity score of 8.8, which is classified as critical.
How can I fix CVE-2022-1802?
To fix CVE-2022-1802, you should update your Mozilla Firefox, Mozilla Thunderbird, or Mozilla Firefox for Android to the corresponding patched versions (Firefox ESR 91.9.1, Firefox 100.0.2, Thunderbird 91.9.1, Firefox for Android 100.3).
Where can I find more information about CVE-2022-1802?
You can find more information about CVE-2022-1802 on the Mozilla Bugzilla page (https://bugzilla.mozilla.org/show_bug.cgi?id=1770137) and the Mozilla security advisories (https://www.mozilla.org/en-US/security/advisories/mfsa2022-19/ and https://www.mozilla.org/security/advisories/mfsa2022-19/).