CVE-2022-28281

If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1755621	Exploit Issue Tracking Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-13/	Exploit Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-14/	Exploit Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-15/	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox_esr::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

History

No history.

Information

Published : 2022-12-22 20:15

Updated : 2024-02-28 19:51

NVD link : CVE-2022-28281

Mitre link : CVE-2022-28281

CVE.ORG link : CVE-2022-28281

JSON object : View

Products Affected

mozilla

firefox
thunderbird
firefox_esr

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2022-28281", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-12-22T20:15:23.023", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1755621", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-13/", "tags": ["Exploit", "Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-14/", "tags": ["Exploit", "Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-15/", "tags": ["Exploit", "Vendor Advisory"], "source": "security@mozilla.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8."}, {"lang": "es", "value": "Si un proceso de contenido comprometido envi\u00f3 una cantidad inesperada de extensiones WebAuthN en un comando de registro al proceso principal, se habr\u00eda producido una escritura fuera de los l\u00edmites que provocar\u00eda da\u00f1os en la memoria y un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Thunderbird < 91.8, Firefox < 99 y Firefox ESR < 91.8."}], "lastModified": "2022-12-30T20:55:42.040", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A841617D-181C-45FF-868A-33DD504B1BA8", "versionEndExcluding": "99.0"}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB18B69A-EE03-4E15-A9AA-FCF442042761", "versionEndExcluding": "91.8"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DCED53B-8838-45E1-A516-90C99C7DF6F9", "versionEndExcluding": "91.8"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}