A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
References
| Link | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1732435 | Exploit Issue Tracking Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2022-04/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2022-05/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2022-06/ | Vendor Advisory |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1732435 | Exploit Issue Tracking Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2022-04/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2022-05/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2022-06/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 06:47
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugzilla.mozilla.org/show_bug.cgi?id=1732435 - Exploit, Issue Tracking, Vendor Advisory | |
| References | () https://www.mozilla.org/security/advisories/mfsa2022-04/ - Vendor Advisory | |
| References | () https://www.mozilla.org/security/advisories/mfsa2022-05/ - Vendor Advisory | |
| References | () https://www.mozilla.org/security/advisories/mfsa2022-06/ - Vendor Advisory |
Information
Published : 2022-12-22 20:15
Updated : 2024-11-21 06:47
NVD link : CVE-2022-22753
Mitre link : CVE-2022-22753
CVE.ORG link : CVE-2022-22753
JSON object : View
Products Affected
mozilla
- thunderbird
- firefox
- firefox_esr
microsoft
- windows
CWE
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition