CVE-2022-22738
First published: Tue Jan 11 2022(Updated: )
Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially exploitable crash.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox ESR | <91.5 | 91.5 |
| <96 | 96 | |
| <91.5 | 91.5 | |
| <91.5 | 91.5 | |
| Mozilla Firefox | <96.0 | |
| Mozilla Firefox ESR | <91.5 | |
| Mozilla Thunderbird | <91.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1742382
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-02/
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-01/
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-03/
- https://www.mozilla.org/security/advisories/mfsa2022-01/
- https://www.mozilla.org/security/advisories/mfsa2022-02/
- https://www.mozilla.org/security/advisories/mfsa2022-03/
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is CVE-2022-22738?
CVE-2022-22738 is a vulnerability that allows an attacker to access out of bounds memory by applying a CSS filter effect, potentially leading to a heap-buffer-overflow and a potentially exploitable crash.
Which software is affected by CVE-2022-22738?
CVE-2022-22738 affects Mozilla Firefox ESR versions earlier than 91.5, Mozilla Firefox versions earlier than 96, and Mozilla Thunderbird versions earlier than 91.5.
What is the severity of CVE-2022-22738?
CVE-2022-22738 has a severity rating of 8.8 (High).
How can I fix CVE-2022-22738?
To fix CVE-2022-22738, update your Mozilla Firefox ESR to version 91.5 or later, update your Mozilla Firefox to version 96 or later, or update your Mozilla Thunderbird to version 91.5 or later.
Where can I find more information about CVE-2022-22738?
You can find more information about CVE-2022-22738 on the Mozilla Bugzilla page and the Mozilla security advisories: mfsa2022-03 and mfsa2022-01.
- collector/mozilla-advisory
- agent/last-modified-date
- agent/first-publish-date
- agent/type
- agent/softwarecombine
- source/Mozilla
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/event
- agent/description
- agent/software-canonical-lookup-request
- agent/tags
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- vendor/mozilla
- canonical/mozilla firefox esr
- canonical/mozilla thunderbird
- canonical/mozilla firefox