The vulnerability in the JavaScript script handler of Firefox browsers, Firefox ESR, and the email client Thunderbird allows a hacker to execute arbitrary code.

🗓️ 02 Sep 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Vulnerability in Mozilla Firefox script handler and Thunderbird allows remote code execution via a crafted web page due to unsafe buffer copying.

Reporter	Title	Published	Views	Family All 283
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 102.2.0-alt1	25 Aug 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 102.2.0-alt1	24 Aug 202200:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud Pak for Multicloud Management Monitoring.	31 Jan 202314:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 102.2ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16 - 2022.4.0	15 Nov 202205:24	–	ibm
Tenable Nessus	Amazon Linux 2 : thunderbird (ALAS-2022-1855)	11 Oct 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2 : firefox (ALASFIREFOX-2023-012)	27 Sep 202300:00	–	nessus
Tenable Nessus	AlmaLinux 8 : thunderbird (ALSA-2022:6164)	31 Aug 202200:00	–	nessus
Tenable Nessus	AlmaLinux 9 : thunderbird (ALSA-2022:6165)	16 Nov 202200:00	–	nessus
Tenable Nessus	AlmaLinux 9 : firefox (ALSA-2022:6174)	16 Nov 202200:00	–	nessus
Tenable Nessus	AlmaLinux 8 : firefox (ALSA-2022:6175)	31 Aug 202200:00	–	nessus

Vulners

Node

mozilla firefox_esrRange<102.2

OR

mozilla thunderbirdRange<102.2

OR

mozilla firefoxRange<104

OR

red_hat red_hat_enterprise_linuxMatch7

OR

red_hat red_hat_enterprise_linuxMatch8

OR

red_hat red_hat_enterprise_linuxMatch9

Source	Link
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-34/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-33/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-36/
ubuntu	www.ubuntu.com/security/notices/USN-5581-1
access	www.access.redhat.com/security/cve/CVE-2022-38478
spidermonkey	www.spidermonkey.dev/
securityonline	www.securityonline.info/cve-2022-38477-cve-2022-38478-firefox-arbitrary-code-execution-flaws/
goslinux	www.goslinux.fssp.gov.ru/2726972/
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/

21 Nov 2023 00:00Current

7.5High risk

Vulners AI Score7.5

CVSS 37.5

CVSS 27.6

EPSS0.00905

mozilla firefox mozilla thunderbird script handler vulnerability buffer copy bug remote code execution