CVE-2022-34477
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Dec 22, 2022
CISA due date
—
Cloudanix analysis
Next patch cycle
SSVC: Track
A media player flaw could let attackers learn private details about files or resources from other websites without permission.
Chainable
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Low
- Impact
- Data Exposure
- Component
- Application
- Class
- Information Disclosure
- Remediation
- Upgrade
- Effort
- Low
- Patch risk
- Low
What it actually does
Inconsistent MediaError message property leaks information about cross-origin resources for same-site scenarios, enabling XS-Leaks attacks that infer resource existence or state.
Why it matters to the business
Attackers may gather sensitive details about user resources or activity across sites, increasing privacy risks and potential for targeted follow-on attacks; widespread use in media playback environments heightens exposure across many systems.
How an attack unfolds
An attacker crafts a page that loads cross-origin media resources and observes MediaError messages to distinguish between successful and failed loads, leaking details that facilitate XS-Leaks without direct access.
How to fix it
Update mplayer to fixed versions: Debian 11 to 2:1.4+ds1-1+deb11u1, Debian 12/13 to 2:1.5+svn38408-1, Ubuntu 16.04 LTS to 2:1.2.1-1ubuntu1.1+esm1, Ubuntu 18.04 LTS to 2:1.3.0-7ubuntu0.2, Ubuntu 20.04 LTS to 2:1.3.0-8+deb10u1build0.20.04.1, Ubuntu 22.04 LTS to 2:1.4+ds1-3ubuntu0.1.
How to confirm the fix worked
Verify installed mplayer package version matches or exceeds the listed fixed versions for the distribution; test media error handling behavior for consistent messages across origins.
Typical attack path
- Attacker hosts malicious page that references target cross-origin media URLs
- Victim browser processes the media element and generates MediaError
- Attacker inspects message property variations to infer resource presence or attributes
- Inferred data used to map user resources or enable further attacks
How to detect it
Search application or system logs for unusual cross-origin media access patterns or repeated error message inspections; review browser or media player logs for anomalous resource probing activity.
What your security team should do
- Prioritize patching mplayer on all affected Debian and Ubuntu systems due to long exposure window
- Review media handling code for similar cross-origin information leaks
- Monitor for any new exploit indicators despite low EPSS
The record
The MediaError message property should be consistent to avoid leaking information about cross-origin resources; however for a same-site cross-origin resource, the message could have leaked information enabling XS-Leaks attacks. This vulnerability affects Firefox < 102.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Enterprise Storage 6 | MozillaFirefox | 0 | 102.2.0-150000.150.56.1 |
| SUSE:Enterprise Storage 6 | MozillaFirefox-branding-SLE | 0 | 102-150000.4.22.1 |
| SUSE:Enterprise Storage 7 | MozillaFirefox | 0 | 102.3.0-150200.152.61.1 |
| SUSE:Enterprise Storage 7 | MozillaFirefox-branding-SLE | 0 | 102-150200.9.10.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | MozillaFirefox | 0 | 102.2.0-150000.150.56.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | MozillaFirefox-branding-SLE | 0 | 102-150000.4.22.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | MozillaFirefox | 0 | 102.2.0-150000.150.56.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | MozillaFirefox-branding-SLE | 0 | 102-150000.4.22.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | MozillaFirefox | 0 | 102.3.0-150200.152.61.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | MozillaFirefox-branding-SLE | 0 | 102-150200.9.10.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | MozillaFirefox | 0 | 102.3.0-150200.152.61.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | MozillaFirefox-branding-SLE | 0 | 102-150200.9.10.1 |
| SUSE:Linux Enterprise High Performance Computing 15-ESPOS | MozillaFirefox | 0 | 102.2.0-150000.150.56.1 |
| SUSE:Linux Enterprise High Performance Computing 15-ESPOS | MozillaFirefox-branding-SLE | 0 | 102-150000.4.22.1 |
| SUSE:Linux Enterprise High Performance Computing 15-LTSS | MozillaFirefox | 0 | 102.2.0-150000.150.56.1 |
| SUSE:Linux Enterprise High Performance Computing 15-LTSS | MozillaFirefox-branding-SLE | 0 | 102-150000.4.22.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP3 | MozillaFirefox | 0 | 102.3.0-150200.152.61.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP3 | MozillaFirefox-branding-SLE | 0 | 102-150200.9.10.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP4 | MozillaFirefox | 0 | 102.3.0-150200.152.61.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP4 | MozillaFirefox-branding-SLE | 0 | 102-150200.9.10.1 |
| SUSE:Linux Enterprise Server 12 SP2-BCL | MozillaFirefox | 0 | 102.2.0-112.130.1 |
| SUSE:Linux Enterprise Server 12 SP2-BCL | MozillaFirefox-branding-SLE | 0 | 102-35.9.1 |
| SUSE:Linux Enterprise Server 12 SP3-BCL | MozillaFirefox | 0 | 102.2.0-112.130.1 |
| SUSE:Linux Enterprise Server 12 SP3-BCL | MozillaFirefox-branding-SLE | 0 | 102-35.9.1 |
| SUSE:Linux Enterprise Server 12 SP4-LTSS | MozillaFirefox | 0 | 102.2.0-112.130.1 |
| SUSE:Linux Enterprise Server 12 SP4-LTSS | MozillaFirefox-branding-SLE | 0 | 102-35.9.1 |
| SUSE:Linux Enterprise Server 12 SP5 | MozillaFirefox | 0 | 102.2.0-112.130.1 |
| SUSE:Linux Enterprise Server 12 SP5 | MozillaFirefox-branding-SLE | 0 | 102-35.9.1 |
| SUSE:Linux Enterprise Server 15 SP1-BCL | MozillaFirefox | 0 | 102.2.0-150000.150.56.1 |
| SUSE:Linux Enterprise Server 15 SP1-BCL | MozillaFirefox-branding-SLE | 0 | 102-150000.4.22.1 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | MozillaFirefox | 0 | 102.2.0-150000.150.56.1 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | MozillaFirefox-branding-SLE | 0 | 102-150000.4.22.1 |
| SUSE:Linux Enterprise Server 15 SP2-BCL | MozillaFirefox | 0 | 102.3.0-150200.152.61.1 |
| SUSE:Linux Enterprise Server 15 SP2-BCL | MozillaFirefox-branding-SLE | 0 | 102-150200.9.10.1 |
| SUSE:Linux Enterprise Server 15 SP2-LTSS | MozillaFirefox | 0 | 102.3.0-150200.152.61.1 |
| SUSE:Linux Enterprise Server 15 SP2-LTSS | MozillaFirefox-branding-SLE | 0 | 102-150200.9.10.1 |
| SUSE:Linux Enterprise Server 15-LTSS | MozillaFirefox | 0 | 102.2.0-150000.150.56.1 |
| SUSE:Linux Enterprise Server 15-LTSS | MozillaFirefox-branding-SLE | 0 | 102-150000.4.22.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | MozillaFirefox | 0 | 102.2.0-112.130.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | MozillaFirefox-branding-SLE | 0 | 102-35.9.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | MozillaFirefox | 0 | 102.2.0-112.130.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | MozillaFirefox-branding-SLE | 0 | 102-35.9.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 | MozillaFirefox | 0 | 102.2.0-150000.150.56.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 | MozillaFirefox-branding-SLE | 0 | 102-150000.4.22.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | MozillaFirefox | 0 | 102.2.0-150000.150.56.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | MozillaFirefox-branding-SLE | 0 | 102-150000.4.22.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | MozillaFirefox | 0 | 102.3.0-150200.152.61.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | MozillaFirefox-branding-SLE | 0 | 102-150200.9.10.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | MozillaFirefox | 0 | 102.2.0-112.130.1 |
| SUSE:Manager Proxy 4.1 | MozillaFirefox | 0 | 102.3.0-150200.152.61.1 |
| SUSE:Manager Proxy 4.1 | MozillaFirefox-branding-SLE | 0 | 102-150200.9.10.1 |
| SUSE:Manager Retail Branch Server 4.1 | MozillaFirefox | 0 | 102.3.0-150200.152.61.1 |
| SUSE:Manager Retail Branch Server 4.1 | MozillaFirefox-branding-SLE | 0 | 102-150200.9.10.1 |
| SUSE:Manager Server 4.1 | MozillaFirefox | 0 | 102.3.0-150200.152.61.1 |
| SUSE:Manager Server 4.1 | MozillaFirefox-branding-SLE | 0 | 102-150200.9.10.1 |
| SUSE:OpenStack Cloud 9 | MozillaFirefox | 0 | 102.2.0-112.130.1 |
| SUSE:OpenStack Cloud 9 | MozillaFirefox-branding-SLE | 0 | 102-35.9.1 |
| SUSE:OpenStack Cloud Crowbar 9 | MozillaFirefox | 0 | 102.2.0-112.130.1 |
| SUSE:OpenStack Cloud Crowbar 9 | MozillaFirefox-branding-SLE | 0 | 102-35.9.1 |
| Ubuntu:18.04:LTS | firefox | 0 | 102.0+build2-0ubuntu0.18.04.1 |
| Ubuntu:20.04:LTS | firefox | 0 | 102.0+build2-0ubuntu0.20.04.1 |
| openSUSE:Leap 15.3 | MozillaFirefox | 0 | 102.3.0-150200.152.61.1 |
| openSUSE:Leap 15.3 | MozillaFirefox-branding-SLE | 0 | 102-150200.9.10.1 |
| openSUSE:Leap 15.4 | MozillaFirefox | 0 | 102.3.0-150200.152.61.1 |
| openSUSE:Leap 15.4 | MozillaFirefox-branding-SLE | 0 | 102-150200.9.10.1 |
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 102.0.1-1.1 |
| openSUSE:Tumbleweed | firefox-esr | 0 | 128.5.1-1.1 |
Related vulnerabilities
- CVE-2023-23601 Navigations were being allowed when dragging a URL from a cross-origin iframe into the… Also affects MozillaFirefox
- CVE-2023-23603 Regular expressions used to filter out forbidden properties and values from style… Also affects MozillaFirefox
- CVE-2023-23602 A mishandled security check when creating a WebSocket in a WebWorker caused the Content… Also affects MozillaFirefox
- CVE-2023-23605 Memory safety bugs present in Firefox 108 and Firefox ESR 102.6. Also affects MozillaFirefox
- CVE-2023-23598 Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating… Also affects MozillaFirefox
- CVE-2022-46881 An optimization in WebGL was incorrect in some cases, and could have led to memory… Also affects MozillaFirefox
- CVE-2022-46882 A use-after-free in WebGL extensions could have led to a potentially exploitable crash. Also affects MozillaFirefox
- CVE-2022-46880 A missing check related to tex units could have led to a use-after-free and potentially… Also affects MozillaFirefox