CVE-2022-38475

Published: 24 August 2022

An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was zero-length, the value was not written to an invalid memory address. This vulnerability affects Firefox < 104.

Notes

mozjs contains a copy of the SpiderMonkey JavaScript engine

starting with Ubuntu 22.04, the firefox package is just a script
that installs the Firefox snap

Priority

Medium

CVSS 3 base score: 6.5

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38475
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-33/#CVE-2022-38475
• https://ubuntu.com/security/notices/USN-5581-1
• NVD
• Launchpad
• Debian