CVE-2022-38478

Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR 91.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.

• CWE-787
• CWE-787

• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1770630%2C1776658Issue Tracking, Not Applicable, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-33/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-34/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-35/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-36/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-37/Vendor Advisory
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1770630%2C1776658Issue Tracking, Not Applicable, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-33/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-34/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-35/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-36/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-37/Vendor Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-38472An attacker could have abused XSLT error handling to associa…6.5
• CVE-2022-38473A cross-origin iframe referencing an XSLT document would inh…8.8
• CVE-2022-38474A website that had permission to access the microphone could…4.3
• CVE-2022-38475An attacker could have written a value to the first element …6.5
• CVE-2022-38476A data race could occur in the <code>PK11_ChangePW</code> fu…7.5
• CVE-2022-38477Mozilla developer Nika Layzell and the Mozilla Fuzzing Team …8.8
• CVE-2022-3848The WP User Merger WordPress plugin before 1.5.3 does not pr…8.8
• CVE-2022-38481An issue was discovered in Mega HOPEX 15.2.0.6110 before V5C…6.1
• CVE-2022-38482A link-manipulation issue was discovered in Mega HOPEX 15.2.…4.3
• CVE-2022-38484An arbitrary file upload and directory traversal vulnerabili…8.8
• CVE-2022-38485A directory traversal vulnerability exists in the AgeVolt Po…6.5
• CVE-2022-38488logrocket-oauth2-example through 2020-05-27 allows SQL injec…9.8