The vulnerability of Mozilla Firefox, Mozilla Firefox ESR, and the email client Thunderbird lies in the copying of buffers without checking the size of the input data. This allows an attacker to execute arbitrary code.

🗓️ 03 Oct 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 7 Views

Buffer copy without size checks in Firefox, Firefox ESR, and Thunderbird enables code execution.

Reporter	Title	Published	Views	Family All 212
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 102.3.0-alt1	10 Oct 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 102.3.0-alt1	9 Oct 202200:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 102.4ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16 - 2022.4.0	29 Nov 202207:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud Pak for Multicloud Management Monitoring.	31 Jan 202314:47	–	ibm
Tenable Nessus	Amazon Linux 2 : thunderbird (ALAS-2022-1900)	7 Dec 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2 : firefox (ALASFIREFOX-2023-010)	27 Sep 202300:00	–	nessus
Tenable Nessus	AlmaLinux 9 : firefox (ALSA-2022:6700)	16 Nov 202200:00	–	nessus
Tenable Nessus	AlmaLinux 9 : thunderbird (ALSA-2022:6717)	16 Nov 202200:00	–	nessus
Tenable Nessus	CentOS 7 : thunderbird (RHSA-2022:6710)	9 Oct 202400:00	–	nessus
Tenable Nessus	CentOS 7 : firefox (RHSA-2022:6711)	9 Oct 202400:00	–	nessus

Vulners

Node

OR

mozilla thunderbirdRange<102.3

mozilla firefox_esrRange<102.3

mozilla firefoxRange<105

red_hat red_hat_enterprise_linuxMatch7

red_hat red_hat_enterprise_linuxMatch8

novell suse_linux_enterprise_server_for_sap_applicationsMatch15

novell suse_linux_enterprise_serverMatch15-ltss

novell opensuse_leapMatch15.3

novell opensuse_leapMatch15.4

red_hat red_hat_enterprise_linuxMatch9

Source	Link
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-40/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-41/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2022-42/
access	www.access.redhat.com/security/cve/cve-2022-40962
suse	www.suse.com/security/cve/CVE-2022-40962.html
security-tracker	www.security-tracker.debian.org/tracker/CVE-2022-40962
ubuntu	www.ubuntu.com/security/CVE-2022-40962
ubuntu	www.ubuntu.com/security/notices/USN-5649-1
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2022100204
goslinux	www.goslinux.fssp.gov.ru/2726972/

17 Mar 2023 00:00Current

8.1High risk

Vulners AI Score8.1

CVSS 37.5

CVSS 27.6

EPSS0.01342

buffer copy size checks firefox firefox esr thunderbird code execution