{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-46874", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "dateUpdated": "2024-08-03T14:39:38.960Z", "dateReserved": "2022-12-09T00:00:00", "datePublished": "2022-12-22T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2023-05-03T00:00:00"}, "descriptions": [{"lang": "en", "value": "A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.<br/>*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6."}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"version": "unspecified", "lessThan": "108", "status": "affected", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"version": "unspecified", "lessThan": "102.6.1", "status": "affected", "versionType": "custom"}, {"version": "unspecified", "lessThan": "102.6", "status": "affected", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"version": "unspecified", "lessThan": "102.6", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-52/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-53/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-51/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-54/"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1746139"}, {"name": "GLSA-202305-06", "tags": ["vendor-advisory"], "url": "https://security.gentoo.org/glsa/202305-06"}, {"name": "GLSA-202305-13", "tags": ["vendor-advisory"], "url": "https://security.gentoo.org/glsa/202305-13"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Drag and Dropped Filenames could have been truncated to malicious extensions"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:39:38.960Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-52/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-53/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-51/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-54/", "tags": ["x_transferred"]}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1746139", "tags": ["x_transferred"]}, {"name": "GLSA-202305-06", "tags": ["vendor-advisory", "x_transferred"], "url": "https://security.gentoo.org/glsa/202305-06"}, {"name": "GLSA-202305-13", "tags": ["vendor-advisory", "x_transferred"], "url": "https://security.gentoo.org/glsa/202305-13"}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "9BB4BE02-7F35-4034-8C61-5DC921524F84", "versionEndExcluding": "108.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2521C8C-7745-4B25-9B20-6C3AFC1D7AF7", "versionEndExcluding": "102.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "895D09F3-D06C-42F6-9937-A6DDCE741FED", "versionEndExcluding": "102.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.<br/>*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6."}, {"lang": "es", "value": "Se podr\u00eda haber truncado el nombre de un archivo con un nombre largo para eliminar la extensi\u00f3n v\u00e1lida, dejando una extensi\u00f3n maliciosa en su lugar. Esto podr\u00eda llevar potencialmente a confusi\u00f3n del usuario y a la ejecuci\u00f3n de c\u00f3digo malicioso.<br>*Nota*: Este problema se incluy\u00f3 originalmente en los avisos para Thunderbird 102.6, pero se omiti\u00f3 un parche (espec\u00edfico para Thunderbird), lo que result\u00f3 en que en realidad se eliminara. corregido en Thunderbird 102.6.1. Esta vulnerabilidad afecta a Firefox &lt; 108, Thunderbird &lt; 102.6.1, Thunderbird &lt; 102.6 y Firefox ESR &lt; 102.6."}], "id": "CVE-2022-46874", "lastModified": "2023-05-03T12:16:32.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-12-22T20:15:46.257", "references": [{"source": "security@mozilla.org", "tags": ["Issue Tracking", "Permissions Required"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1746139"}, {"source": "security@mozilla.org", "url": "https://security.gentoo.org/glsa/202305-06"}, {"source": "security@mozilla.org", "url": "https://security.gentoo.org/glsa/202305-13"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-51/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-52/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-53/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-54/"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Matthias Zoellner as the original reporter.", "affected_release": [{"advisory": "RHSA-2022:9072", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "firefox-0:102.6.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9079", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "thunderbird-0:102.6.0-2.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9067", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:102.6.0-1.el8_7", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9074", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:102.6.0-2.el8_7", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9071", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "firefox-0:102.6.0-1.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9077", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "thunderbird-0:102.6.0-2.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9070", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "firefox-0:102.6.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9076", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "thunderbird-0:102.6.0-2.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9070", "cpe": "cpe:/a:redhat:rhel_tus:8.2", "package": "firefox-0:102.6.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9076", "cpe": "cpe:/a:redhat:rhel_tus:8.2", "package": "thunderbird-0:102.6.0-2.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9070", "cpe": "cpe:/a:redhat:rhel_e4s:8.2", "package": "firefox-0:102.6.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9076", "cpe": "cpe:/a:redhat:rhel_e4s:8.2", "package": "thunderbird-0:102.6.0-2.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9069", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "firefox-0:102.6.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9075", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "thunderbird-0:102.6.0-2.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9068", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "firefox-0:102.6.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9078", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "thunderbird-0:102.6.0-2.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9065", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "firefox-0:102.6.0-1.el9_1", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9080", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "thunderbird-0:102.6.0-2.el9_1", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9066", "cpe": "cpe:/a:redhat:rhel_eus:9.0", "package": "firefox-0:102.6.0-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "release_date": "2022-12-15T00:00:00Z"}, {"advisory": "RHSA-2022:9081", "cpe": "cpe:/a:redhat:rhel_eus:9.0", "package": "thunderbird-0:102.6.0-2.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "release_date": "2022-12-15T00:00:00Z"}], "bugzilla": {"description": "Mozilla: Drag and Dropped Filenames could have been truncated to malicious extensions", "id": "2153449", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153449"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-222", "details": ["A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.<br/>*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6.", "The Mozilla Foundation Security Advisory describes this flaw as:\nA file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code."], "name": "CVE-2022-46874", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2022-12-13T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-46874\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-46874\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2022-52/#CVE-2022-46874\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2022-53\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2022-54/#CVE-2022-46874"], "statement": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Note that this CVE was actually fixed in Thunderbird 102.6.1 despite being initially included in the advisories for Thunderbird 102.6. A future update for Thunderbird 102.7 will address this CVE in Red Hat Enterprise Linux.", "threat_severity": "Moderate", "upstream_fix": "thunderbird 102.6.1, firefox 102.6"}