CVE-2022-22747

What it actually does

Handling an empty PKCS7 sequence within certificate data after acceptance of an untrusted certificate triggers a crash in the browser's certificate parsing logic.

Why it matters to the business

Users experience unexpected browser or email client crashes when visiting sites or processing messages with specially crafted certificates, leading to workflow interruptions and potential loss of unsaved data until the application is restarted.

How an attack unfolds

An attacker crafts a web page or email that supplies an untrusted certificate containing an empty PKCS7 sequence; once the browser or client accepts the certificate, the malformed data causes the application to crash during parsing.

How to fix it

Upgrade Mozilla Firefox to version 96 or later, Firefox ESR to 91.5 or later, and Thunderbird to 91.5 or later. Apply updates through the product's built-in updater or package manager as soon as possible.

How to confirm the fix worked

Verify installed versions meet or exceed Firefox 96, ESR 91.5, or Thunderbird 91.5; test certificate handling with known trigger cases in a lab environment to confirm absence of crash.

Typical attack path

1. Attacker prepares a malicious certificate or site that triggers certificate acceptance
2. Victim's browser or client accepts the untrusted certificate
3. Empty PKCS7 sequence in the certificate data is processed
4. Application crashes due to unhandled parsing condition

How to detect it

Review application crash logs and telemetry for segmentation faults or aborts occurring during certificate validation routines; correlate with web or email traffic involving untrusted certificates.

What your security team should do

• Prioritize patching all affected Mozilla products to the fixed versions listed in remediation guidance
• Monitor EPSS trend and re-evaluate if exploit maturity changes
• Communicate update urgency to end users via standard patch management channels