CVE-2022-22756
Published: 9 February 2022
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Notes
| Author | Note |
|---|---|
| tyhicks | mozjs contains a copy of the SpiderMonkey JavaScript engine |
Priority
Medium
CVSS 3 base score: 8.8
Status
| Package | Release | Status |
|---|---|---|
|
firefox Launchpad, Ubuntu, Debian |
bionic |
Released
(97.0+build2-0ubuntu0.18.04.1)
|
| focal |
Released
(97.0+build2-0ubuntu0.20.04.1)
|
|
| impish |
Released
(97.0+build2-0ubuntu0.21.10.1)
|
|
| jammy |
Released
(97.0+build2-0ubuntu1)
|
|
| kinetic |
Released
(97.0+build2-0ubuntu1)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(97)
|
|
| xenial |
Needed
|
|
|
mozjs38 Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
mozjs52 Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
mozjs68 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Needs triage
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
mozjs78 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| impish |
Ignored
(reached end-of-life)
|
|
| jammy |
Needs triage
|
|
| kinetic |
Needs triage
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
thunderbird Launchpad, Ubuntu, Debian |
bionic |
Released
(1:91.7.0+build2-0ubuntu0.18.04.1)
|
| focal |
Released
(1:91.7.0+build2-0ubuntu0.20.04.1)
|
|
| impish |
Released
(1:91.7.0+build2-0ubuntu0.21.10.1)
|
|
| jammy |
Released
(1:91.6.1+build1-0ubuntu1)
|
|
| kinetic |
Released
(1:91.6.1+build1-0ubuntu1)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(91.6)
|
|
| xenial |
Needed
|
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22756
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-04/#CVE-2022-22756
- https://www.mozilla.org/en-US/security/advisories/mfsa2022-05/#CVE-2022-22756
- https://ubuntu.com/security/notices/USN-5284-1
- https://ubuntu.com/security/notices/USN-5345-1
- NVD
- Launchpad
- Debian