CVE-2022-46872 — HIGH (8.6)

Vulnerability Description

An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.<br>*This bug only affects Thunderbird for Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6.

CVSS Score

8.6

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Mozilla	Firefox	< 108.0
Mozilla	Firefox Esr	< 102.6
Mozilla	Thunderbird	< 102.6
Linux	Linux Kernel	-

Related Weaknesses (CWE)

CWE-125

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1799156Issue TrackingPermissions RequiredVendor Advisory
https://security.gentoo.org/glsa/202305-06
https://security.gentoo.org/glsa/202305-13
https://www.mozilla.org/security/advisories/mfsa2022-51/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-52/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-53/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1799156Issue TrackingPermissions RequiredVendor Advisory
https://security.gentoo.org/glsa/202305-06
https://security.gentoo.org/glsa/202305-13
https://www.mozilla.org/security/advisories/mfsa2022-51/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-52/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-53/Vendor Advisory

FAQ

What is CVE-2022-46872?

CVE-2022-46872 is a vulnerability with a CVSS score of 8.6 (HIGH). An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.<br>*This bug only affects Thunderbird for Linux. Othe...

How severe is CVE-2022-46872?

CVE-2022-46872 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-46872?

Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird, Linux Linux Kernel.