CVE-2022-34470

Session history navigations may have led to a use-after-free and potentially exploitable crash

Critical · published December 22, 2022

CVSS v3.1
9.8
EPSS
1%
Percentile
65.0
In the wild
Unconfirmed
What it is

🔥 A sneaky use-after-free vulnerability lurks in Firefox and Thunderbird, potentially crashing your browser! Think of it like a busy restaurant where the waiter forgets to clear a table, resulting in diners accidentally tripping over each other as they navigate the space. In this case, users may find themselves navigating a session history that hasn’t been properly cleared, leading to unexpected crashes instead of smooth sailing! An attacker could exploit this vulnerability to cause your browser to crash unexpectedly, leading to potential data loss or disruption during critical tasks. This can be especially devastating if you’re working on sensitive information or important communications!

Put simply

Think of it like a busy restaurant where the waiter forgets to clear a table, resulting in diners accidentally tripping over each other as they navigate the space. In this case, users may find themselves navigating a session history that hasn’t been properly cleared, leading to unexpected crashes instead of smooth sailing! This use-after-free flaw allows the browser to mishandle session history navigations, which could be exploited to trigger a crash. Specifically, it affects Firefox versions below 102 and Thunderbird versions below 102 and 91.11.

What to do

An attacker could exploit this vulnerability to cause your browser to crash unexpectedly, leading to potential data loss or disruption during critical tasks. This can be especially devastating if you’re working on sensitive information or important communications! To secure your system, immediately update Firefox and Thunderbird to versions 102 or later for Firefox, and 91.11 or later for Thunderbird. It's crucial to regularly check for updates to ensure your applications are protected against such vulnerabilities! You've got this! Follow these steps and you'll have your browsers securely updated in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01088 · 65.0th percentile
Published
2022-12-22T00:00Z
EPSS history
Timeline
  • 22 DEC 00:00Z
    Session history navigations may have led to a use-after-free and potentially exploitable crash
    cvelistv5