CVE-2022-46879

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Mozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 107. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Dec 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-46888.8Improper Authorization in GitHub repository usememos/memos prior to 0.9.0.CVE-2022-468806.5A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was ad CVE-2022-468818.8An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash. *Note*: T CVE-2022-468829.8A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Firefox < 107, Firefox ES CVE-2022-468838.8Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Fir CVE-2022-468848.8A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an inopportune time. This could have CVE-2022-468858.8Mozilla developers Timothy Nikkel, Ashley Hale, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105. Some of the CVE-2022-468866.1There exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitr CVE-2022-468879.8Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] CVE-2022-468886.1Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web scri CVE-2022-468895.4A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject CVE-2022-46898.8Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.