CVE-2022-46871: High severity Mozilla Firefox ESR vulnerability
An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 118.0.2-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.3.1esr-1~deb10u1Fixed in 102.15.0esr-1~deb11u1Fixed in 115.3.1esr-1~deb11u1Fixed in 102.15.1esr-1~deb12u1Fixed in 115.3.0esr-1~deb12u1Fixed in 115.3.0esr-1 - Upgrade
Upgrade
debian/libusrsctpto a version that resolves this vulnerability.Fixed in 0.9.3.0+20201102-2Fixed in 0.9.5.0-2 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.3.1-1~deb10u1Fixed in 1:102.13.1-1~deb11u1Fixed in 1:115.3.1-1~deb11u1Fixed in 1:102.15.1-1~deb12u1Fixed in 1:115.3.1-1~deb12u1Fixed in 1:115.3.1-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 102.7 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 108 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 102.7
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2022-46871?
CVE-2022-46871 is a vulnerability in an out-of-date library (libusrsctp) that could potentially be exploited.
Which software are affected by CVE-2022-46871?
Firefox < 108, Firefox ESR < 102.7, Debian Linux 10.0, Debian Linux 11.0, Thunderbird < 102.7.
What is the severity of CVE-2022-46871?
CVE-2022-46871 has a severity rating of 8.8 (High).
What is the remedy for CVE-2022-46871?
Update Firefox to version 108 or later, Firefox ESR to version 102.7 or later, Debian Linux to version 10.0 or later, Thunderbird to version 102.7 or later.
Where can I find more information about CVE-2022-46871?
You can find more information about CVE-2022-46871 in the references: [Mozilla Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1795697), [Mozilla Security Advisories](https://www.mozilla.org/en-US/security/advisories/mfsa2023-02/), [Debian LTS Announce](https://lists.debian.org/debian-lts-announce/2023/01/msg00015.html).