#VU67504 Input validation error in Mozilla products - CVE-2022-40957

Vulnerability identifier: #VU67504

Vulnerability risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-40957

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Firefox for Android
Mobile applications / Apps for mobile phones
Mozilla Firefox
Client/Desktop applications / Web browsers
Firefox ESR
Client/Desktop applications / Web browsers

Vendor: Mozilla

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to inconsistent data in instruction and data cache when creating wasm code. A remote attacker can trick the victim to open a specially crafted web page, trigger memory corruption and potentially execute arbitrary code.

Note, the vulnerability affects Firefox on ARM64 platforms only.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Firefox for Android: 100.1.0 - 104.2.0

Mozilla Firefox: 90.0 - 104.0.2

Firefox ESR: 91.0 - 91.13.0, 102.0 - 102.2.0

---

External links
https://www.mozilla.org/en-US/security/advisories/mfsa2022-40/
https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.