The vulnerability of the PK11_ChangePW function in the Mozilla Firefox browser and Thunderbird email client allows a hacker to trigger a service failure.

🗓️ 26 Aug 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

A use after free vulnerability in PK11 Change Password in Firefox and Thunderbird can cause service failure.

Reporter	Title	Published	Views	Family All 172
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 102.2.0-alt1	25 Aug 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 102.2.0-alt1	24 Aug 202200:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud Pak for Multicloud Management Monitoring.	31 Jan 202314:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 102.2ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16 - 2022.4.0	15 Nov 202205:24	–	ibm
Tenable Nessus	Amazon Linux 2 : thunderbird (ALAS-2022-1855)	11 Oct 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2 : firefox (ALASFIREFOX-2023-012)	27 Sep 202300:00	–	nessus
Tenable Nessus	AlmaLinux 8 : thunderbird (ALSA-2022:6164)	31 Aug 202200:00	–	nessus
Tenable Nessus	AlmaLinux 9 : thunderbird (ALSA-2022:6165)	16 Nov 202200:00	–	nessus
Tenable Nessus	AlmaLinux 9 : firefox (ALSA-2022:6174)	16 Nov 202200:00	–	nessus
Tenable Nessus	AlmaLinux 8 : firefox (ALSA-2022:6175)	31 Aug 202200:00	–	nessus

Vulners

Node

mozilla firefox_esrRange<102.2

OR

mozilla thunderbirdRange<102.2

OR

red_hat red_hat_enterprise_linuxMatch6

OR

red_hat red_hat_enterprise_linuxMatch8

Source	Link
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-34/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-36/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2022-38476
access	www.access.redhat.com/security/cve/cve-2022-38476
goslinux	www.goslinux.fssp.gov.ru/2726972/
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.6/
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20221220SE16
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1221SE17MD
wiki	www.wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0131SE47MD

17 Mar 2023 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 34.3

CVSS 25

EPSS0.0082

PK11 Change Password firefox thunderbird memory after free service interruption