CVE-2022-40958

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1779993
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-42/
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-40/
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/
• https://www.mozilla.org/security/advisories/mfsa2022-40/
• https://www.mozilla.org/security/advisories/mfsa2022-41/
• https://www.mozilla.org/security/advisories/mfsa2022-42/

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2022-42
• MFSA2022-41
• MFSA2022-40

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2022-3266
• CVE-2022-40959
• CVE-2022-40960
• CVE-2022-40958
• CVE-2022-40956
• CVE-2022-40957
• CVE-2022-3155
• CVE-2022-40962
• CVE-2022-46880
• CVE-2022-40961

Frequently Asked Questions

• What is the vulnerability ID of this vulnerability?

  The vulnerability ID is CVE-2022-40958.

• What is the severity level of CVE-2022-40958?

  The severity level of CVE-2022-40958 is medium.

• Which software products are affected by CVE-2022-40958?

  CVE-2022-40958 affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.

• How can an attacker exploit CVE-2022-40958?

  An attacker can exploit CVE-2022-40958 by injecting a cookie with certain special characters on a shared subdomain to set and overwrite cookies from a secure context.

• Are there any known remediation steps for CVE-2022-40958?

  Yes, updating to Firefox ESR version 102.3 or higher, Thunderbird version 102.3 or higher, or Firefox version 105 or higher will remediate CVE-2022-40958.