CVE-2022-28282
Published: 22 December 2022
Summary
CVE-2022-28282 is a medium-severity Use After Free (CWE-416) vulnerability in Mozilla Firefox. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-28282 is a use-after-free vulnerability (CWE-416) that can be triggered when a link element with rel="localization" causes an object to be destroyed during JavaScript execution and subsequently referenced through a freed pointer, resulting in a potentially exploitable crash. The flaw affects Mozilla Thunderbird versions prior to 91.8, Firefox versions prior to 99, and Firefox ESR versions prior to 91.8, and carries a CVSS 3.1 score of 6.5 reflecting network attack vector, low complexity, and high availability impact.
An unauthenticated remote attacker can exploit the issue by serving a malicious webpage or email containing the crafted link; successful triggering requires user interaction such as loading the content in an affected client and can lead to denial of service via browser or application crash without direct compromise of confidentiality or integrity.
Mozilla advisories MFSA2022-13, MFSA2022-14, and MFSA2022-15, along with the associated Bugzilla entry, direct users to apply the patched releases that remediate the flaw. The associated EPSS score has remained low, with a current value of 0.0808 and a peak of 0.0921.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-32734
Vulnerability details
By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object through a freed pointer, leading to a potential exploitable crash. This vulnerability affects Thunderbird < 91.8,…
more
Firefox < 99, and Firefox ESR < 91.8.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.