CVE-2022-45412

CVSS v3.1 8.8 (High)

EPSS 0.21 % (59^th)

Affected Products 6

Advisories 34

When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer. <br>This bug only affects Thunderbird on Unix-based operated systems (Android, Linux, MacOS). Windows is unaffected.. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

Weaknesses

CWE-59: Improper Link Resolution Before File Access ('Link Following')

CVE Status: PUBLISHED
CNA: Mozilla Corporation
Published Date: 2022-12-22 20:15:43
(21 months ago)
Updated Date: 2023-01-05 13:59:24
(20 months ago)

Affected Products

Mozilla

Configuration #1

AND

		CPE23	Up To
OR
	Mozilla Firefox prior 107.0 version	cpe:2.3:a:mozilla:firefox	< 107.0
OR
	Running on/with
	Mozilla Firefox Esr prior 102.5 version	cpe:2.3:a:mozilla:firefox_esr	< 102.5
OR
	Running on/with
	Mozilla Thunderbird prior 102.5 version	cpe:2.3:a:mozilla:thunderbird	< 102.5
OR
	Running on/with
	Apple Macos	cpe:2.3:o:apple:macos:-
OR
	Running on/with
	Google Android	cpe:2.3:o:google:android:-
OR
	Running on/with
	Linux Kernel	cpe:2.3:o:linux:linux_kernel:-

Weaknesses

Affected Products

Apple

Google

Linux

Mozilla

Configuration #1