High · published December 23, 2022
CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 96.6th percentile for exploit probability.
🚨 A sneaky use-after-free bug has been spotted in Firefox and Thunderbird, making it a prime target for attackers! 🔥 Think of this vulnerability like a misplaced package on a delivery truck that unexpectedly gets tossed out during transit — if the driver isn't careful, that open box can cause chaos! This flaw allows attackers to exploit the memory mishap, possibly leading to remote code execution. Imagine the consequences: they could gain unauthorized access to your data or take control of your device without you even knowing!
Think of this vulnerability like a misplaced package on a delivery truck that unexpectedly gets tossed out during transit — if the driver isn't careful, that open box can cause chaos! The issue stems from an improper handling of XSLT parameters during processing. This oversight can lead to a use-after-free condition, allowing attackers to manipulate memory and execute arbitrary code.
This flaw allows attackers to exploit the memory mishap, possibly leading to remote code execution. Imagine the consequences: they could gain unauthorized access to your data or take control of your device without you even knowing! Upgrade to Firefox version 97.0.2 or later, Firefox ESR 91.6.1 or later, Thunderbird 91.6.2 or later, and Firefox for Android 97.3.0 or later. It's essential to patch as soon as possible to protect your systems! You’ve got this! Just follow these steps and you’ll have your defenses up in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mozilla/firefox | < 91.6.1 | 91.6.1 |
| mozilla/firefox | < 97.0.2 | 97.0.2 |
| mozilla/firefox_focus | < 97.3.0 | 97.3.0 |
| mozilla/firefox_mobile | < 97.3.0 | 97.3.0 |
| mozilla/thunderbird | < 91.6.2 | 91.6.2 |