CVE-2022-22742

What it actually does

Out-of-bounds memory access during text insertion in edit mode leads to a crash in the affected Mozilla products.

Why it matters to the business

Users of older Firefox, Firefox ESR, and Thunderbird versions may experience unexpected application crashes while editing content, resulting in lost work and temporary disruption to browsing or email activities.

How an attack unfolds

An attacker crafts a webpage or email containing specific characters that trigger the flaw when the victim enters edit mode and inserts text, causing an out-of-bounds access and potential crash.

How to fix it

Upgrade Firefox to version 96 or later, Firefox ESR to 91.5 or later, and Thunderbird to 91.5 or later.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases and test text insertion in edit mode with previously triggering content.

Typical attack path

1. Attacker prepares malicious content with triggering characters
2. Victim opens the content in an affected browser or email client
3. Victim enters edit mode and inserts text
4. Out-of-bounds memory access occurs resulting in a crash

How to detect it

Review application crash logs and memory dumps for Mozilla products around the time of text editing activity for signs of abnormal termination.

What your security team should do

• Prioritize updating all instances of affected Mozilla products to the fixed versions
• Monitor for application crashes in logs during text editing operations
• Educate users on keeping browsers and email clients current