CVE-2022-45412 Information disclosure in Firefox
An attacker can read uninitialized memory when resolving specific symlinks in Firefox or Thunderbird on Unix systems, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-45412?
CVE-2022-45412 is a high-severity vulnerability in Mozilla Firefox, published on 22 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer. <br>*This bug only affects Thunderbird on Unix-based operated systems (Android, Linux, MacOS). Windows is unaffected.*. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.
Weakness: CWE-59
Which versions are affected by CVE-2022-45412?
It affects 3 products.
Products include Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird.
How do I fix CVE-2022-45412?
Upgrade to a fixed version.
Is CVE-2022-45412 being exploited?
There is no known exploitation of CVE-2022-45412 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as DEBIAN-CVE-2022-45412, GHSA-ww43-23jx-qcpc, UBUNTU-CVE-2022-45412.