CVE-2022-46881

EUVD-2022-49661
An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash.
*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 106. This vulnerability affects Firefox < 106, Firefox ESR < 102.6, and Thunderbird < 102.6.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA-ADPADP
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 46%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
𝑥
< 106.0
mozillafirefox_esr
𝑥
< 102.6
mozillathunderbird
𝑥
< 102.6
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
132.0.1-1
fixed
firefox-esr
bookworm
115.14.0esr-1~deb12u1
fixed
bookworm (security)
128.4.0esr-1~deb12u1
fixed
bullseye
115.14.0esr-1~deb11u1
fixed
bullseye (security)
128.4.0esr-1~deb11u1
fixed
sid
128.4.0esr-1
fixed
trixie
128.3.1esr-2
fixed
thunderbird
bookworm
1:115.12.0-1~deb12u1
fixed
bookworm (security)
1:128.4.0esr-1~deb12u1
fixed
bullseye
1:115.12.0-1~deb11u1
fixed
bullseye (security)
1:128.4.0esr-1~deb11u1
fixed
sid
1:128.4.0esr-1
fixed
trixie
1:128.4.0esr-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
thunderbird
bionic
Fixed 1:102.7.1+build2-0ubuntu0.18.04.1
released
focal
Fixed 1:102.7.1+build2-0ubuntu0.20.04.1
released
jammy
Fixed 1:102.7.1+build2-0ubuntu0.22.04.1
released
kinetic
Fixed 1:102.7.1+build2-0ubuntu0.22.10.1
released
lunar
Fixed 1:102.7.1+build2-0ubuntu1
released
trusty
ignored
xenial
ignored
Common Weakness Enumeration
References
https://bugzilla.mozilla.org/show_bug.cgi?id=1770930
https://security.gentoo.org/glsa/202305-06
https://security.gentoo.org/glsa/202305-13
https://www.mozilla.org/security/advisories/mfsa2022-44/
https://www.mozilla.org/security/advisories/mfsa2022-52/
https://www.mozilla.org/security/advisories/mfsa2022-53/
https://bugzilla.mozilla.org/show_bug.cgi?id=1770930
https://security.gentoo.org/glsa/202305-06
https://security.gentoo.org/glsa/202305-13
https://www.mozilla.org/security/advisories/mfsa2022-44/
https://www.mozilla.org/security/advisories/mfsa2022-52/
https://www.mozilla.org/security/advisories/mfsa2022-53/