CVE-2022-36319

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-1021

Affected software

Vendor	Product	Versions
Mozilla	Firefox ESR	>= unspecified, < 102.1; >= unspecified, < 91.12
Mozilla	Firefox	>= unspecified, < 103
Mozilla	Thunderbird	>= unspecified, < 102.1; >= unspecified, < 91.12

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1737722Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-28/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-29/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-30/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-31/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-32/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1737722Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-28/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-29/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-30/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-31/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-32/Vendor Advisory

Timeline

Published: Dec 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-36326.5The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to m CVE-2022-363209.8Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs showed evidence of me CVE-2022-363216.5In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases CVE-2022-363228.8In JetBrains TeamCity before 2022.04.2 build parameter injection was possible CVE-2022-363239.1Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges CVE-2022-363247.5Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypa CVE-2022-363254.8Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated rem CVE-2022-363264.9An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount CVE-2022-363279.8Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to CVE-2022-363284.9Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrar CVE-2022-363297.5An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in We CVE-2022-36333.3A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function j1939_session_destroy of the file net/can