CVE-2022-46875: Medium severity Mozilla Thunderbird vulnerability
The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer. <br>Note: This issue only affected Mac OS operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6.
Other sources
The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer. Note: This issue only affected Mac OS operating systems. Other operating systems are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 102.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 108 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 102.6 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 102.6.0-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2022-46875?
CVE-2022-46875 is a vulnerability that allows the execution of commands on a user's computer when downloading .atloc and .ftploc files in Firefox and Thunderbird.
Which operating systems are affected by CVE-2022-46875?
This vulnerability only affects Mac OS operating systems.
Which versions of Firefox and Thunderbird are affected by CVE-2022-46875?
Firefox versions below 108 and Firefox ESR versions below 102.6 are affected. Thunderbird versions below 102.6 are also affected.
What is the severity of CVE-2022-46875?
The severity of CVE-2022-46875 is medium with a CVSS score of 6.5.
How can I fix CVE-2022-46875?
Upgrade to Firefox version 108 or higher, Firefox ESR version 102.6 or higher, or Thunderbird version 102.6 or higher to mitigate this vulnerability.