VulnerableCode Vulnerability Details

Search for vulnerabilities

Vulnerability details: VCID-uzgv-qhq2-aaac

Essentials
Severities (102)
References (26)
Severity details (9)
Exploits (1)
EPSS
History (0)

Vulnerability ID	VCID-uzgv-qhq2-aaac
Aliases	CVE-2022-26485
Summary	Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
Status	Published
Exploitability	2.0
Weighted Severity	9.0
Risk	10.0
Affected and Fixed Packages	Package Details

Weaknesses (1)

CWE-416

Use After Free

System	Score	Found at
rhas	Critical	https://access.redhat.com/errata/RHSA-2022:0815
rhas	Critical	https://access.redhat.com/errata/RHSA-2022:0816
rhas	Critical	https://access.redhat.com/errata/RHSA-2022:0817
rhas	Critical	https://access.redhat.com/errata/RHSA-2022:0818
rhas	Critical	https://access.redhat.com/errata/RHSA-2022:0824
rhas	Important	https://access.redhat.com/errata/RHSA-2022:0843
rhas	Important	https://access.redhat.com/errata/RHSA-2022:0845
rhas	Important	https://access.redhat.com/errata/RHSA-2022:0847
rhas	Important	https://access.redhat.com/errata/RHSA-2022:0850
rhas	Important	https://access.redhat.com/errata/RHSA-2022:0853
cvssv3	8.8	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-26485.json
epss	0.00382	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.00382	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.00382	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.00382	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.00382	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.00382	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.00382	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.00382	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.00382	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.00382	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.00435	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.00703	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01692	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01696	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01696	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.01696	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.02252	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.02252	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.02252	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.02252	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.0445	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.04461	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.04461	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.04461	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.04461	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.04461	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.04461	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
epss	0.37408	https://api.first.org/data/v1/epss?cve=CVE-2022-26485
cvssv3.1	8.8	https://bugzilla.mozilla.org/show_bug.cgi?id=1758062
ssvc	Attend	https://bugzilla.mozilla.org/show_bug.cgi?id=1758062
rhbs	urgent	https://bugzilla.redhat.com/show_bug.cgi?id=2061736
cvssv3.1	8.8	https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3	8.8	https://nvd.nist.gov/vuln/detail/CVE-2022-26485
cvssv3.1	8.8	https://nvd.nist.gov/vuln/detail/CVE-2022-26485
generic_textual	high	https://www.mozilla.org/en-US/security/advisories/mfsa2022-09
cvssv3.1	8.8	https://www.mozilla.org/security/advisories/mfsa2022-09/
ssvc	Attend	https://www.mozilla.org/security/advisories/mfsa2022-09/

Reference id	Reference type	URL
		https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-26485.json
		https://api.first.org/data/v1/epss?cve=CVE-2022-26485
		https://bugzilla.mozilla.org/show_bug.cgi?id=1758062
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26485
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26486
		https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
		https://www.mozilla.org/security/advisories/mfsa2022-09/
2061736		https://bugzilla.redhat.com/show_bug.cgi?id=2061736
cpe:2.3:a:mozilla:firefox::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox::::::::
cpe:2.3:a:mozilla:firefox::::::android::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox::::::android::*
cpe:2.3:a:mozilla:firefox_esr::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox_esr::::::::
cpe:2.3:a:mozilla:firefox_focus::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox_focus::::::::
cpe:2.3:a:mozilla:thunderbird::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird::::::::
CVE-2022-26485		https://nvd.nist.gov/vuln/detail/CVE-2022-26485
mfsa2022-09		https://www.mozilla.org/en-US/security/advisories/mfsa2022-09
RHSA-2022:0815		https://access.redhat.com/errata/RHSA-2022:0815
RHSA-2022:0816		https://access.redhat.com/errata/RHSA-2022:0816
RHSA-2022:0817		https://access.redhat.com/errata/RHSA-2022:0817
RHSA-2022:0818		https://access.redhat.com/errata/RHSA-2022:0818
RHSA-2022:0824		https://access.redhat.com/errata/RHSA-2022:0824
RHSA-2022:0843		https://access.redhat.com/errata/RHSA-2022:0843
RHSA-2022:0845		https://access.redhat.com/errata/RHSA-2022:0845
RHSA-2022:0847		https://access.redhat.com/errata/RHSA-2022:0847
RHSA-2022:0850		https://access.redhat.com/errata/RHSA-2022:0850
RHSA-2022:0853		https://access.redhat.com/errata/RHSA-2022:0853
USN-5314-1		https://usn.ubuntu.com/5314-1/

Data source	KEV
Date added	March 7, 2022
Description	Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.
Required action	Apply updates per vendor instructions.
Due date	March 21, 2022
Note	https://nvd.nist.gov/vuln/detail/CVE-2022-26485
Ransomware campaign use	Unknown

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-26485.json

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1758062

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-28T21:32:55Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1758062

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-26485

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-26485

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2022-09/

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-28T21:32:55Z/ Found at https://www.mozilla.org/security/advisories/mfsa2022-09/

Exploit Prediction Scoring System (EPSS)

Percentile	0.73718
EPSS Score	0.00382
Published At	Nov. 20, 2024, midnight

Date	Actor	Action	Source	VulnerableCode Version
There are no relevant records.