CVE-2022-22756: Code Injection
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 91.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 97 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 91.6 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 97.0-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 91.6.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 97.0-r0 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 91.6.0-r0 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:91.6.0-1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2022-22756?
The severity of CVE-2022-22756 is medium with a value of 4.
Which software is affected by CVE-2022-22756?
Mozilla Firefox ESR version 91.6, Mozilla Firefox version up to exclusive 97, and Mozilla Thunderbird version 91.6 are affected by CVE-2022-22756.
How can CVE-2022-22756 be exploited?
CVE-2022-22756 can be exploited by convincing a user to drag and drop an image to their desktop or other folder, which can result in the object being changed into an executable script that runs arbitrary code when clicked.
Is there a remedy available for CVE-2022-22756?
Yes, Mozilla provides a remedy for CVE-2022-22756.
Where can I find more information about CVE-2022-22756?
You can find more information about CVE-2022-22756 in the Mozilla Bugzilla and Mozilla Security Advisories.