CVE-2022-28289

Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.

• CWE-787
• CWE-787

• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1663508%2C1744525%2C1753508%2C1757476%2C1757805%2C1758549%2C1758776Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-13/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-14/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-15/Vendor Advisory
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1663508%2C1744525%2C1753508%2C1757476%2C1757805%2C1758549%2C1758776Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-13/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-14/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-15/Vendor Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-28283The sourceMapURL feature in devtools was missing security ch…6.5
• CVE-2022-28284SVG's <code>&lt;use&gt;</code> element could have been used …8.8
• CVE-2022-28285When generating the assembly code for <code>MLoadTypedArrayE…6.5
• CVE-2022-28286Due to a layout change, iframe contents could have been rend…5.4
• CVE-2022-28287In unusual circumstances, selecting text could cause text se…6.5
• CVE-2022-28288Mozilla developers and community members Randell Jesup, Seba…8.8
• CVE-2022-2829Cross-site Scripting (XSS) - Stored in GitHub repository yet…5.4
• CVE-2022-28290Reflective Cross-Site Scripting vulnerability in WordPress C…6.1
• CVE-2022-28291Insufficiently Protected Credentials: An authenticated user …6.5
• CVE-2022-2830Deserialization of Untrusted Data vulnerability in the messa…9.8
• CVE-2022-28300This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2022-28301This vulnerability allows remote attackers to execute arbitr…7.8