CVE-2022-46880: Use After Free
A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 102.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 105 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 102.6 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 102.6.0-r0 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 102.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:102.6.0-1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2022-46880?
The severity of CVE-2022-46880 is high with a CVSS score of 6.5.
Which products are affected by CVE-2022-46880?
CVE-2022-46880 affects Mozilla Thunderbird, Mozilla Firefox, and Mozilla Firefox ESR.
What is the potential impact of CVE-2022-46880?
CVE-2022-46880 could lead to a use-after-free vulnerability, potentially causing a crash and exploitation.
What is the remedy for CVE-2022-46880?
The remedy for CVE-2022-46880 is to update to the fixed versions of Mozilla Thunderbird 102.6, Mozilla Firefox 105, or Mozilla Firefox ESR 102.6.
Where can I find more information about CVE-2022-46880?
You can find more information about CVE-2022-46880 in the Mozilla Security Advisory MFSA2022-53 and MFSA2022-40.