CVE-2022-45421

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Dec 22, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-454227.8When LG SmartShare is installed, local privilege escalation is possible through DLL Hijacking attack. The LG ID is LVE-HOT-220005.CVE-2022-454237.5Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credCVE-2022-454245.3Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key. An attacker can obtain the AES crypto key byCVE-2022-454257.5Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by expCVE-2022-454266.5Some Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of ordinary users, by seCVE-2022-454277.2Some Dahua software products have a vulnerability of unrestricted upload of file. After obtaining the permissions of administrators, by sendCVE-2022-454282.7Some Dahua software products have a vulnerability of sensitive information leakage. After obtaining the permissions of administrators, by seCVE-2022-454297.5Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatCVE-2022-45435.5A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR bCVE-2022-454303.7Some Dahua software products have a vulnerability of unauthenticated enable or disable SSHD service. After bypassing the firewall access conCVE-2022-454317.5Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the firewall access contrCVE-2022-454325.3Some Dahua software products have a vulnerability of unauthenticated search for devices. After bypassing the firewall access control policy,
CVE-2022-45421: High severity, CVSS 8.8 | Vulnix