CVE-2022-34470 Use after free in Firefox
Session history navigation triggers a use-after-free, allowing attackers to cause crashes or potentially execute code in Firefox and Thunderbird.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-34470?
CVE-2022-34470 is a critical use after free vulnerability in Mozilla Firefox, published on 22 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Session history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11.
Weakness: CWE-416
Which versions are affected by CVE-2022-34470?
It affects 3 products.
Products include Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird.
How do I fix CVE-2022-34470?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2022-34470 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-34470 exists.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as DEBIAN-CVE-2022-34470, GHSA-cvcg-29j6-c4g8, UBUNTU-CVE-2022-34470.