VulnerableCode Vulnerability Details

Search for vulnerabilities

Vulnerability details: VCID-885t-y8wa-aaag

Essentials
Severities (104)
References (39)
Severity details (14)
Exploits (0)
EPSS
History (0)

Vulnerability ID	VCID-885t-y8wa-aaag
Aliases	CVE-2022-22740
Summary	Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Status	Published
Exploitability	0.5
Weighted Severity	8.0
Risk	4.0
Affected and Fixed Packages	Package Details

Weaknesses (1)

CWE-416

Use After Free

System	Score	Found at
rhas	Important	https://access.redhat.com/errata/RHSA-2022:0123
rhas	Important	https://access.redhat.com/errata/RHSA-2022:0124
rhas	Important	https://access.redhat.com/errata/RHSA-2022:0125
rhas	Important	https://access.redhat.com/errata/RHSA-2022:0126
rhas	Important	https://access.redhat.com/errata/RHSA-2022:0127
rhas	Important	https://access.redhat.com/errata/RHSA-2022:0128
rhas	Important	https://access.redhat.com/errata/RHSA-2022:0129
rhas	Important	https://access.redhat.com/errata/RHSA-2022:0130
rhas	Important	https://access.redhat.com/errata/RHSA-2022:0131
rhas	Important	https://access.redhat.com/errata/RHSA-2022:0132
cvssv3	8.8	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22740.json
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00186	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00252	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00252	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00252	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00252	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00252	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00252	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00252	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00252	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00252	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00252	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00252	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00252	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00252	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00252	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00252	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00252	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
epss	0.00766	https://api.first.org/data/v1/epss?cve=CVE-2022-22740
cvssv3.1	8.8	https://bugzilla.mozilla.org/show_bug.cgi?id=1742334
ssvc	Track	https://bugzilla.mozilla.org/show_bug.cgi?id=1742334
rhbs	high	https://bugzilla.redhat.com/show_bug.cgi?id=2039565
cvssv3	8.8	https://nvd.nist.gov/vuln/detail/CVE-2022-22740
cvssv3.1	8.8	https://nvd.nist.gov/vuln/detail/CVE-2022-22740
generic_textual	high	https://www.mozilla.org/en-US/security/advisories/mfsa2022-01
generic_textual	high	https://www.mozilla.org/en-US/security/advisories/mfsa2022-02
generic_textual	high	https://www.mozilla.org/en-US/security/advisories/mfsa2022-03
cvssv3.1	8.8	https://www.mozilla.org/security/advisories/mfsa2022-01/
ssvc	Track	https://www.mozilla.org/security/advisories/mfsa2022-01/
cvssv3.1	8.8	https://www.mozilla.org/security/advisories/mfsa2022-02/
ssvc	Track	https://www.mozilla.org/security/advisories/mfsa2022-02/
cvssv3.1	8.8	https://www.mozilla.org/security/advisories/mfsa2022-03/
ssvc	Track	https://www.mozilla.org/security/advisories/mfsa2022-03/

Reference id	Reference type	URL
		https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22740.json
		https://api.first.org/data/v1/epss?cve=CVE-2022-22740
		https://bugzilla.mozilla.org/show_bug.cgi?id=1742334
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4140
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22737
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22738
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22739
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22740
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22741
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22742
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22743
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22745
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22747
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22748
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22751
		https://www.mozilla.org/security/advisories/mfsa2022-01/
		https://www.mozilla.org/security/advisories/mfsa2022-02/
		https://www.mozilla.org/security/advisories/mfsa2022-03/
2039565		https://bugzilla.redhat.com/show_bug.cgi?id=2039565
cpe:2.3:a:mozilla:firefox::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox::::::::
cpe:2.3:a:mozilla:firefox_esr::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox_esr::::::::
cpe:2.3:a:mozilla:thunderbird::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird::::::::
CVE-2022-22740		https://nvd.nist.gov/vuln/detail/CVE-2022-22740
mfsa2022-01		https://www.mozilla.org/en-US/security/advisories/mfsa2022-01
mfsa2022-02		https://www.mozilla.org/en-US/security/advisories/mfsa2022-02
mfsa2022-03		https://www.mozilla.org/en-US/security/advisories/mfsa2022-03
RHSA-2022:0123		https://access.redhat.com/errata/RHSA-2022:0123
RHSA-2022:0124		https://access.redhat.com/errata/RHSA-2022:0124
RHSA-2022:0125		https://access.redhat.com/errata/RHSA-2022:0125
RHSA-2022:0126		https://access.redhat.com/errata/RHSA-2022:0126
RHSA-2022:0127		https://access.redhat.com/errata/RHSA-2022:0127
RHSA-2022:0128		https://access.redhat.com/errata/RHSA-2022:0128
RHSA-2022:0129		https://access.redhat.com/errata/RHSA-2022:0129
RHSA-2022:0130		https://access.redhat.com/errata/RHSA-2022:0130
RHSA-2022:0131		https://access.redhat.com/errata/RHSA-2022:0131
RHSA-2022:0132		https://access.redhat.com/errata/RHSA-2022:0132
USN-5229-1		https://usn.ubuntu.com/5229-1/
USN-5246-1		https://usn.ubuntu.com/5246-1/
USN-5248-1		https://usn.ubuntu.com/5248-1/

No exploits are available.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-22740.json

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1742334

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-16T15:31:42Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1742334

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-22740

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-22740

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2022-01/

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-16T15:31:42Z/ Found at https://www.mozilla.org/security/advisories/mfsa2022-01/

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2022-02/

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-16T15:31:42Z/ Found at https://www.mozilla.org/security/advisories/mfsa2022-02/

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2022-03/

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-16T15:31:42Z/ Found at https://www.mozilla.org/security/advisories/mfsa2022-03/

Exploit Prediction Scoring System (EPSS)

Percentile	0.37432
EPSS Score	0.00186
Published At	March 28, 2025, 12:55 p.m.

Date	Actor	Action	Source	VulnerableCode Version
There are no relevant records.