CVE-2022-45406: Use After Free
If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing a potentially exploitable crash.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2022-45406?
The severity of CVE-2022-45406 is high with a severity value of 7.
Which software products are affected by CVE-2022-45406?
The software products affected by CVE-2022-45406 are Mozilla Thunderbird (up to version 102.5), Mozilla Firefox ESR (up to version 102.5), and Mozilla Firefox (up to version 107).
How can CVE-2022-45406 be exploited?
CVE-2022-45406 can be exploited through a use-after-free vulnerability caused by a deleted JavaScript realm in a BaseShape object.
What is the remedy for CVE-2022-45406?
The recommended remedy for CVE-2022-45406 is to update Mozilla Thunderbird to version 102.5, Mozilla Firefox ESR to version 102.5, and Mozilla Firefox to version 107.
Are there any references for CVE-2022-45406?
Yes, you can find references for CVE-2022-45406 at the following links: [Mozilla Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1791975), [Mozilla Security Advisory MFSAs](https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/), and [Mozilla Security Advisory MFSAs](https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/).