CVE catalog

CVE-2022-22753

firefox-esr: CVE-2022-22753

[CVE catalog]

Severity
High · CVSS 7.1CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.65% · Oct 25, 2026

A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianfirefox-esrsid153.5.1esr-1not affected
Debianfirefox-esrforky153.5.1esr-1not affected
Debianfirefox-esrtrixie140.15.0esr-1~deb13u1not affected
Debianfirefox-esrtrixie-security153.5.1esr-1~deb13u1not affected
Debianfirefox-esrbookworm140.12.0esr-1~deb12u1not affected
Debianfirefox-esrbookworm-security153.5.1esr-1~deb12u1not affected
Debianthunderbirdsid1:153.6.0esr-1not affected
Debianthunderbirdforky1:153.5.0esr-1not affected
Debianthunderbirdtrixie1:140.12.0esr-1~deb13u1not affected
Debianthunderbirdtrixie-security1:153.5.1esr-1~deb13u2not affected
Debianthunderbirdbookworm1:140.12.0esr-1~deb12u1not affected
Debianthunderbirdbookworm-security1:153.5.1esr-1~deb12u1not affected
SuseMozillaFirefoxlinux enterprise server 11 sp4-ltss91.6.0-78.162.2fixed
SuseMozillaFirefoxlinux enterprise high performance computing 15-espos91.6.0-150.18.1fixed
SuseMozillaFirefoxlinux enterprise high performance computing 15-ltss91.6.0-150.18.1fixed
SuseMozillaFirefoxlinux enterprise high performance computing 15 sp1-espos91.6.0-150.18.1fixed
SuseMozillaFirefoxlinux enterprise high performance computing 15 sp1-ltss91.6.0-150.18.1fixed
SuseMozillaFirefoxlinux enterprise server 15-ltss91.6.0-150.18.1fixed
SuseMozillaFirefoxlinux enterprise server 15 sp1-bcl91.6.0-150.18.1fixed
SuseMozillaFirefoxlinux enterprise server 15 sp1-ltss91.6.0-150.18.1fixed
SuseMozillaFirefoxlinux enterprise server for sap applications 1591.6.0-150.18.1fixed
SuseMozillaFirefoxlinux enterprise server for sap applications 15 sp191.6.0-150.18.1fixed
SuseMozillaFirefoxenterprise storage 691.6.0-150.18.1fixed
SuseMozillaFirefoxlinux enterprise module for desktop applications 15 sp391.6.0-152.15.1fixed
SuseMozillaFirefoxlinux enterprise high performance computing 15 sp2-espos91.6.0-152.15.1fixed
SuseMozillaFirefoxlinux enterprise high performance computing 15 sp2-ltss91.6.0-152.15.1fixed
SuseMozillaFirefoxlinux enterprise real time 15 sp291.6.0-152.15.1fixed
SuseMozillaFirefoxlinux enterprise server 15 sp2-bcl91.6.0-152.15.1fixed
SuseMozillaFirefoxlinux enterprise server 15 sp2-ltss91.6.0-152.15.1fixed
SuseMozillaFirefoxlinux enterprise server for sap applications 15 sp291.6.0-152.15.1fixed
SuseMozillaFirefoxmanager proxy 4.191.6.0-152.15.1fixed
SuseMozillaFirefoxmanager retail branch server 4.191.6.0-152.15.1fixed
SuseMozillaFirefoxmanager server 4.191.6.0-152.15.1fixed
SuseMozillaFirefoxenterprise storage 791.6.0-152.15.1fixed
SuseMozillaFirefoxhpe helion openstack 891.6.0-112.89.1fixed
SuseMozillaFirefoxopenstack cloud 891.6.0-112.89.1fixed
SuseMozillaFirefoxopenstack cloud 991.6.0-112.89.1fixed
SuseMozillaFirefoxopenstack cloud crowbar 891.6.0-112.89.1fixed
SuseMozillaFirefoxopenstack cloud crowbar 991.6.0-112.89.1fixed
SuseMozillaFirefoxlinux enterprise server for sap applications 12 sp391.6.0-112.89.1fixed
SuseMozillaFirefoxlinux enterprise server for sap applications 12 sp491.6.0-112.89.1fixed
SuseMozillaFirefoxlinux enterprise software development kit 12 sp591.6.0-112.89.1fixed
SuseMozillaFirefoxlinux enterprise server 12 sp2-bcl91.6.0-112.89.1fixed
SuseMozillaFirefoxlinux enterprise server 12 sp3-ltss91.6.0-112.89.1fixed
SuseMozillaFirefoxlinux enterprise server 12 sp3-bcl91.6.0-112.89.1fixed
SuseMozillaFirefoxlinux enterprise server 12 sp4-ltss91.6.0-112.89.1fixed
SuseMozillaFirefoxlinux enterprise server 12 sp591.6.0-112.89.1fixed
SuseMozillaFirefoxlinux enterprise server for sap applications 12 sp591.6.0-112.89.1fixed
OpensuseMozillaThunderbirdtumbleweed91.6.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianfirefox-esrsourcesidNot affectedunimportantNot reportedNot reported
Debianfirefox-esrsourceforkyNot affectedunimportantNot reportedNot reported
Debianfirefox-esrsourcetrixieNot affectedunimportantNot reportedNot reported
Debianfirefox-esrsourcebookwormNot affectedunimportantNot reportedNot reported
DebianthunderbirdsourcesidNot affectedunimportantNot reportedNot reported
DebianthunderbirdsourceforkyNot affectedunimportantNot reportedNot reported
DebianthunderbirdsourcetrixieNot affectedunimportantNot reportedNot reported
DebianthunderbirdsourcebookwormNot affectedunimportantNot reportedNot reported
SuseMozillaFirefoxrpmlinux enterprise server 11 sp4-ltss91.6.0-78.162.2Not reportedSUSE-SU-2022:14896-1Not reported
SuseMozillaFirefoxrpmlinux enterprise high performance computing 15-espos91.6.0-150.18.1Not reportedSUSE-SU-2022:0676-1Not reported
SuseMozillaFirefoxrpmlinux enterprise high performance computing 15-ltss91.6.0-150.18.1Not reportedSUSE-SU-2022:0676-1Not reported
SuseMozillaFirefoxrpmlinux enterprise high performance computing 15 sp1-espos91.6.0-150.18.1Not reportedSUSE-SU-2022:0676-1Not reported
SuseMozillaFirefoxrpmlinux enterprise high performance computing 15 sp1-ltss91.6.0-150.18.1Not reportedSUSE-SU-2022:0676-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server 15-ltss91.6.0-150.18.1Not reportedSUSE-SU-2022:0676-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server 15 sp1-bcl91.6.0-150.18.1Not reportedSUSE-SU-2022:0676-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server 15 sp1-ltss91.6.0-150.18.1Not reportedSUSE-SU-2022:0676-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server for sap applications 1591.6.0-150.18.1Not reportedSUSE-SU-2022:0676-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server for sap applications 15 sp191.6.0-150.18.1Not reportedSUSE-SU-2022:0676-1Not reported
SuseMozillaFirefoxrpmenterprise storage 691.6.0-150.18.1Not reportedSUSE-SU-2022:0676-1Not reported
SuseMozillaFirefoxrpmlinux enterprise module for desktop applications 15 sp391.6.0-152.15.1Not reportedSUSE-SU-2022:0696-1Not reported
SuseMozillaFirefoxrpmlinux enterprise high performance computing 15 sp2-espos91.6.0-152.15.1Not reportedSUSE-SU-2022:0696-1Not reported
SuseMozillaFirefoxrpmlinux enterprise high performance computing 15 sp2-ltss91.6.0-152.15.1Not reportedSUSE-SU-2022:0696-1Not reported
SuseMozillaFirefoxrpmlinux enterprise real time 15 sp291.6.0-152.15.1Not reportedSUSE-SU-2022:0696-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server 15 sp2-bcl91.6.0-152.15.1Not reportedSUSE-SU-2022:0696-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server 15 sp2-ltss91.6.0-152.15.1Not reportedSUSE-SU-2022:0696-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server for sap applications 15 sp291.6.0-152.15.1Not reportedSUSE-SU-2022:0696-1Not reported
SuseMozillaFirefoxrpmmanager proxy 4.191.6.0-152.15.1Not reportedSUSE-SU-2022:0696-1Not reported
SuseMozillaFirefoxrpmmanager retail branch server 4.191.6.0-152.15.1Not reportedSUSE-SU-2022:0696-1Not reported
SuseMozillaFirefoxrpmmanager server 4.191.6.0-152.15.1Not reportedSUSE-SU-2022:0696-1Not reported
SuseMozillaFirefoxrpmenterprise storage 791.6.0-152.15.1Not reportedSUSE-SU-2022:0696-1Not reported
SuseMozillaFirefoxrpmhpe helion openstack 891.6.0-112.89.1Not reportedSUSE-SU-2022:0565-1Not reported
SuseMozillaFirefoxrpmopenstack cloud 891.6.0-112.89.1Not reportedSUSE-SU-2022:0565-1Not reported
SuseMozillaFirefoxrpmopenstack cloud 991.6.0-112.89.1Not reportedSUSE-SU-2022:0565-1Not reported
SuseMozillaFirefoxrpmopenstack cloud crowbar 891.6.0-112.89.1Not reportedSUSE-SU-2022:0565-1Not reported
SuseMozillaFirefoxrpmopenstack cloud crowbar 991.6.0-112.89.1Not reportedSUSE-SU-2022:0565-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server for sap applications 12 sp391.6.0-112.89.1Not reportedSUSE-SU-2022:0565-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server for sap applications 12 sp491.6.0-112.89.1Not reportedSUSE-SU-2022:0565-1Not reported
SuseMozillaFirefoxrpmlinux enterprise software development kit 12 sp591.6.0-112.89.1Not reportedSUSE-SU-2022:0565-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server 12 sp2-bcl91.6.0-112.89.1Not reportedSUSE-SU-2022:0565-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server 12 sp3-ltss91.6.0-112.89.1Not reportedSUSE-SU-2022:0565-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server 12 sp3-bcl91.6.0-112.89.1Not reportedSUSE-SU-2022:0565-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server 12 sp4-ltss91.6.0-112.89.1Not reportedSUSE-SU-2022:0565-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server 12 sp591.6.0-112.89.1Not reportedSUSE-SU-2022:0565-1Not reported
SuseMozillaFirefoxrpmlinux enterprise server for sap applications 12 sp591.6.0-112.89.1Not reportedSUSE-SU-2022:0565-1Not reported
OpensuseMozillaThunderbirdrpmtumbleweed91.6.0-1.1Not reportedOPENSUSE-SU-2024:11842-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [firefox-esr]Unknown
    Details (4)
    • 140.12.0esr-1~deb12u1 · amd64 · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · arm64 · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · amd64 · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · arm64 · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

Next results

Observed:

References