CVE-2022-40958: Medium severity Mozilla Thunderbird vulnerability
By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 102.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 102.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 105 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 102.3.0-r0 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 102.3.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:102.3.0-1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2022-40958.
What is the severity level of CVE-2022-40958?
The severity level of CVE-2022-40958 is medium.
Which software products are affected by CVE-2022-40958?
CVE-2022-40958 affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.
How can an attacker exploit CVE-2022-40958?
An attacker can exploit CVE-2022-40958 by injecting a cookie with certain special characters on a shared subdomain to set and overwrite cookies from a secure context.
Are there any known remediation steps for CVE-2022-40958?
Yes, updating to Firefox ESR version 102.3 or higher, Thunderbird version 102.3 or higher, or Firefox version 105 or higher will remediate CVE-2022-40958.