CVE-2022-31737: Buffer Overflow
A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 101 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 101 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 91.10 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 101.0-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 91.10.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 101.0-r0 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 91.10.0-r0 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.10.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:91.10.0-1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2022-31737?
CVE-2022-31737 is a vulnerability that allows a malicious webpage to cause an out-of-bounds write in WebGL, leading to memory corruption and potentially exploitable crashes in Mozilla Firefox, Firefox ESR, and Thunderbird.
How severe is CVE-2022-31737?
CVE-2022-31737 has a severity rating of 7, which is considered high.
Which software products are affected by CVE-2022-31737?
Mozilla Firefox (up to exclusive version 101), Firefox ESR (up to exclusive version 91.10), and Thunderbird (up to exclusive version 91.10) are affected by CVE-2022-31737.
How can a malicious webpage exploit CVE-2022-31737?
A malicious webpage can exploit CVE-2022-31737 by causing an out-of-bounds write in WebGL, leading to memory corruption and potentially exploitable crashes.
Where can I find more information about CVE-2022-31737?
You can find more information about CVE-2022-31737 on Mozilla's official security advisories: [mfsa2022-20](https://www.mozilla.org/en-US/security/advisories/mfsa2022-20/) and [mfsa2022-22](https://www.mozilla.org/en-US/security/advisories/mfsa2022-22/), as well as on [Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1743767).