VulnerableCode Vulnerability Details

Search for vulnerabilities

Vulnerability details: VCID-cakz-5fn1-aaab

Essentials
Severities (107)
References (33)
Severity details (13)
Exploits (0)
EPSS
History (0)

Vulnerability ID	VCID-cakz-5fn1-aaab
Aliases	CVE-2022-1196
Summary	After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8 and Firefox ESR < 91.8.
Status	Published
Exploitability	0.5
Weighted Severity	8.0
Risk	4.0
Affected and Fixed Packages	Package Details

Weaknesses (1)

CWE-416

Use After Free

System	Score	Found at
rhas	Important	https://access.redhat.com/errata/RHSA-2022:1283
rhas	Important	https://access.redhat.com/errata/RHSA-2022:1284
rhas	Important	https://access.redhat.com/errata/RHSA-2022:1285
rhas	Important	https://access.redhat.com/errata/RHSA-2022:1286
rhas	Important	https://access.redhat.com/errata/RHSA-2022:1287
rhas	Important	https://access.redhat.com/errata/RHSA-2022:1301
rhas	Important	https://access.redhat.com/errata/RHSA-2022:1302
rhas	Important	https://access.redhat.com/errata/RHSA-2022:1303
rhas	Important	https://access.redhat.com/errata/RHSA-2022:1305
rhas	Important	https://access.redhat.com/errata/RHSA-2022:1326
cvssv3	6.1	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-1196.json
epss	0.00101	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00101	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00101	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00101	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00101	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00101	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00101	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00101	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00101	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00101	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00101	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00101	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00101	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00101	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00101	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00101	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00129	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
epss	0.00533	https://api.first.org/data/v1/epss?cve=CVE-2022-1196
cvssv3.1	6.5	https://bugzilla.mozilla.org/show_bug.cgi?id=1750679
ssvc	Track	https://bugzilla.mozilla.org/show_bug.cgi?id=1750679
rhbs	medium	https://bugzilla.redhat.com/show_bug.cgi?id=2072561
cvssv3.1	6.1	https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3	6.5	https://nvd.nist.gov/vuln/detail/CVE-2022-1196
cvssv3.1	6.5	https://nvd.nist.gov/vuln/detail/CVE-2022-1196
archlinux	High	https://security.archlinux.org/AVG-2712
generic_textual	high	https://www.mozilla.org/en-US/security/advisories/mfsa2022-14
generic_textual	high	https://www.mozilla.org/en-US/security/advisories/mfsa2022-15
cvssv3.1	6.5	https://www.mozilla.org/security/advisories/mfsa2022-14/
ssvc	Track	https://www.mozilla.org/security/advisories/mfsa2022-14/
cvssv3.1	6.5	https://www.mozilla.org/security/advisories/mfsa2022-15/
ssvc	Track	https://www.mozilla.org/security/advisories/mfsa2022-15/

Reference id	Reference type	URL
		https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-1196.json
		https://api.first.org/data/v1/epss?cve=CVE-2022-1196
		https://bugzilla.mozilla.org/show_bug.cgi?id=1750679
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1097
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1196
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1197
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24713
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28281
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28282
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28285
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28286
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28289
		https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
		https://www.mozilla.org/security/advisories/mfsa2022-14/
		https://www.mozilla.org/security/advisories/mfsa2022-15/
2072561		https://bugzilla.redhat.com/show_bug.cgi?id=2072561
AVG-2712		https://security.archlinux.org/AVG-2712
cpe:2.3:a:mozilla:firefox_esr::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox_esr::::::::
cpe:2.3:a:mozilla:thunderbird::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird::::::::
CVE-2022-1196		https://nvd.nist.gov/vuln/detail/CVE-2022-1196
mfsa2022-14		https://www.mozilla.org/en-US/security/advisories/mfsa2022-14
mfsa2022-15		https://www.mozilla.org/en-US/security/advisories/mfsa2022-15
RHSA-2022:1283		https://access.redhat.com/errata/RHSA-2022:1283
RHSA-2022:1284		https://access.redhat.com/errata/RHSA-2022:1284
RHSA-2022:1285		https://access.redhat.com/errata/RHSA-2022:1285
RHSA-2022:1286		https://access.redhat.com/errata/RHSA-2022:1286
RHSA-2022:1287		https://access.redhat.com/errata/RHSA-2022:1287
RHSA-2022:1301		https://access.redhat.com/errata/RHSA-2022:1301
RHSA-2022:1302		https://access.redhat.com/errata/RHSA-2022:1302
RHSA-2022:1303		https://access.redhat.com/errata/RHSA-2022:1303
RHSA-2022:1305		https://access.redhat.com/errata/RHSA-2022:1305
RHSA-2022:1326		https://access.redhat.com/errata/RHSA-2022:1326
USN-5393-1		https://usn.ubuntu.com/5393-1/

No exploits are available.

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-1196.json

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1750679

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-16T15:27:49Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1750679

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-1196

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-1196

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://www.mozilla.org/security/advisories/mfsa2022-14/

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-16T15:27:49Z/ Found at https://www.mozilla.org/security/advisories/mfsa2022-14/

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://www.mozilla.org/security/advisories/mfsa2022-15/

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-16T15:27:49Z/ Found at https://www.mozilla.org/security/advisories/mfsa2022-15/

Exploit Prediction Scoring System (EPSS)

Percentile	0.42527
EPSS Score	0.00101
Published At	Nov. 1, 2024, midnight

Date	Actor	Action	Source	VulnerableCode Version
There are no relevant records.