CVE-2022-29917

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR…

Critical · published December 22, 2022

CVSS v3.1
9.8
EPSS
1%
Percentile
64.1
In the wild
Unconfirmed
What it is

🔥 Memory safety bugs in Firefox and Thunderbird could let attackers run arbitrary code — an open invitation to a digital heist! 🚨 Think of your web browser like a bustling restaurant kitchen. If a recipe is followed incorrectly (due to memory corruption), it could result in a disastrous dish that could poison the entire meal. In this case, if attackers get crafty enough, they could whip up their own unapproved dish with malicious intent. An attacker exploiting this vulnerability could potentially gain full control of affected systems, running harmful code that compromises user data, steals sensitive information, or even turns your device into a botnet. The implications are absolutely devastating, especially for those using outdated versions of Firefox or Thunderbird!

Put simply

Think of your web browser like a bustling restaurant kitchen. If a recipe is followed incorrectly (due to memory corruption), it could result in a disastrous dish that could poison the entire meal. In this case, if attackers get crafty enough, they could whip up their own unapproved dish with malicious intent. This vulnerability arises from memory safety issues in Firefox 99 and Firefox ESR 91.8, allowing potential attackers to manipulate memory allocations, leading to arbitrary code execution. The affected versions include Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.

What to do

An attacker exploiting this vulnerability could potentially gain full control of affected systems, running harmful code that compromises user data, steals sensitive information, or even turns your device into a botnet. The implications are absolutely devastating, especially for those using outdated versions of Firefox or Thunderbird! Immediately update all affected applications to version 91.9 or higher for Thunderbird and Firefox ESR, and version 100 or higher for Firefox. Regularly check for updates to ensure that you're not running vulnerable software. You've got this! Keep your software updated and secure, and you'll protect your digital kitchen from any nasty surprises! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01054 · 64.1th percentile
Published
2022-12-22T00:00Z
EPSS history
Timeline
  • 22 DEC 00:00Z
    Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR…
    cvelistv5