CVE-2022-26485: Mozilla Firefox Use-After-Free Vulnerability

Published Mar 5, 2022
·
Updated

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: Removing an XSLT parameter during processing could have led to an exploitable use-after-free issue. There were reports of attacks in the wild abusing this flaw.

Other sources

As per Mozilla Security Advisory: Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw.

Reporter: Wang Gang, Liu Jialei, Du Sihang, Huang Yi & Yang Kang of 360 ATA Name: the Mozilla project

Advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2022-09/#CVE-2022-26485

— Red Hat

Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.

— CISA

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.

Affected Software

27 affected componentsFixes available
redhat/firefox<0:91.7.0-3.el7_9
0:91.7.0-3.el7_9
redhat/thunderbird<0:91.7.0-2.el7_9
0:91.7.0-2.el7_9
redhat/firefox<0:91.7.0-3.el8_5
0:91.7.0-3.el8_5
redhat/thunderbird<0:91.7.0-2.el8_5
0:91.7.0-2.el8_5
redhat/firefox<0:91.7.0-3.el8_1
0:91.7.0-3.el8_1
redhat/thunderbird<0:91.7.0-2.el8_1
0:91.7.0-2.el8_1
redhat/firefox<0:91.7.0-3.el8_2
0:91.7.0-3.el8_2
redhat/thunderbird<0:91.7.0-2.el8_2
0:91.7.0-2.el8_2
redhat/firefox<0:91.7.0-3.el8_4
0:91.7.0-3.el8_4
redhat/thunderbird<0:91.7.0-2.el8_4
0:91.7.0-2.el8_4
redhat/Firefox<97.0.2
97.0.2
redhat/Firefox ESR<91.6.1
91.6.1
redhat/Thunderbird<91.6.2
91.6.2
Mozilla Firefox<97.0.2
97.0.2
Mozilla Firefox ESR<91.6.1
91.6.1
All of the following
Mozilla Firefox=97.3
Google Android
Mozilla Focus<97.3
97.3
Mozilla Thunderbird<91.6.2
91.6.2
Mozilla Firefox<97.0.2
Mozilla Firefox Android<97.3.0
Mozilla Firefox ESR<91.6.1
Mozilla Firefox Focus<97.3.0
Mozilla Thunderbird<91.6.2
Mozilla Firefox
Mozilla Firefox<91.6.1
Mozilla Firefox<97.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el7_9
  2. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el7_9
  3. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el8_5
  4. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el8_5
  5. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el8_1
  6. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el8_1
  7. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el8_2
  8. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el8_2
  9. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el8_4
  10. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el8_4
  11. Upgrade

    Upgrade Firefox to a version that resolves this vulnerability.

    Fixed in 97.0.2
  12. Upgrade

    Upgrade Firefox ESR to a version that resolves this vulnerability.

    Fixed in 91.6.1
  13. Upgrade

    Upgrade Mozilla Focus to a version that resolves this vulnerability.

    Fixed in 97.3
  14. Upgrade

    Upgrade Thunderbird to a version that resolves this vulnerability.

    Fixed in 91.6.2
  15. Upgrade

    Upgrade redhat/Firefox to a version that resolves this vulnerability.

    Fixed in 97.0.2
  16. Upgrade

    Upgrade redhat/Firefox ESR to a version that resolves this vulnerability.

    Fixed in 91.6.1
  17. Upgrade

    Upgrade redhat/Thunderbird to a version that resolves this vulnerability.

    Fixed in 91.6.2

Event History

Mar 5, 2022
CVE Published
12:00 AM
Mar 7, 2022
Known Exploited
via CISA·12:00 AM
Mar 8, 2022
Data Sourced
via Red Hat·01:14 PM
DescriptionSeverityAffected Software
Dec 22, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2022-26485?

CVE-2022-26485 is a use-after-free vulnerability affecting Mozilla Firefox, Firefox ESR, Firefox for Android, Thunderbird, and Focus.

2

How severe is CVE-2022-26485?

CVE-2022-26485 has a severity score of 8.8 (critical).

3

Which versions of Firefox are affected by CVE-2022-26485?

Firefox versions prior to 97.0.2 are affected by CVE-2022-26485.

4

How can I fix CVE-2022-26485?

To fix CVE-2022-26485, update Firefox to version 97.0.2 or later.

5

Are there any references for CVE-2022-26485?

Yes, you can find references for CVE-2022-26485 in the following links: [link1](https://www.cve.org/CVERecord?id=CVE-2022-26485), [link2](https://nvd.nist.gov/vuln/detail/CVE-2022-26485), [link3](https://bugzilla.redhat.com/show_bug.cgi?id=2061736), [link4](https://access.redhat.com/errata/RHSA-2022:0824).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203