CVE-2022-28281
Mozilla: Out of bounds write due to unexpected WebAuthN Extensions
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
5Exploited in Wild
-Decision
Descriptions
If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.
Si un proceso de contenido comprometido envió una cantidad inesperada de extensiones WebAuthN en un comando de registro al proceso principal, se habría producido una escritura fuera de los límites que provocaría daños en la memoria y un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Thunderbird < 91.8, Firefox < 99 y Firefox ESR < 91.8.
The Mozilla Foundation Security Advisory describes this flaw as:
If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-03-31 CVE Reserved
- 2022-04-08 CVE Published
- 2022-04-08 First Exploit
- 2024-08-03 CVE Updated
- 2024-08-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-787: Out-of-bounds Write
CAPEC
References (7)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/0vercl0k/CVE-2022-28281 | 2022-04-08 | |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1755621 | 2024-08-03 | |
| https://www.mozilla.org/security/advisories/mfsa2022-13 | 2024-08-03 | |
| https://www.mozilla.org/security/advisories/mfsa2022-14 | 2024-08-03 | |
| https://www.mozilla.org/security/advisories/mfsa2022-15 | 2024-08-03 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2022-28281 | 2022-04-12 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2072560 | 2022-04-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | < 99.0 Search vendor "Mozilla" for product "Firefox" and version " < 99.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | < 91.8 Search vendor "Mozilla" for product "Firefox Esr" and version " < 91.8" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Thunderbird Search vendor "Mozilla" for product "Thunderbird" | < 91.8 Search vendor "Mozilla" for product "Thunderbird" and version " < 91.8" | - |
Affected
| ||||||