CVE-2022-22747

Name	CVE-2022-22747
Description	After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2880-1, DLA-2881-1, DLA-2898-1, DSA-5044-1, DSA-5045-1, DSA-5062-1, ELA-550-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
firefox (PTS)	sid	130.0-2	fixed
firefox-esr (PTS)	jessie, jessie (lts)	68.9.0esr-1~deb8u2	vulnerable
	stretch (security), stretch (lts), stretch	91.11.0esr-1~deb9u1	fixed
	buster (security), buster, buster (lts)	115.12.0esr-1~deb10u1	fixed
	bullseye	115.14.0esr-1~deb11u1	fixed
	bullseye (security)	115.15.0esr-1~deb11u1	fixed
	bookworm	115.14.0esr-1~deb12u1	fixed
	bookworm (security)	115.15.0esr-1~deb12u1	fixed
	trixie	115.14.0esr-1	fixed
	sid	115.15.0esr-1	fixed
nss (PTS)	jessie, jessie (lts)	2:3.26-1+debu8u18	fixed
	stretch (security)	2:3.26.2-1.1+deb9u5	fixed
	stretch (lts), stretch	2:3.26.2-1.1+deb9u7	fixed
	buster (security), buster, buster (lts)	2:3.42.1-1+deb10u8	fixed
	bullseye (security), bullseye	2:3.61-1+deb11u3	fixed
	bookworm	2:3.87.1-1	fixed
	sid, trixie	2:3.103-1	fixed
thunderbird (PTS)	jessie, jessie (lts)	1:68.9.0-1~deb8u2	vulnerable
	stretch (security), stretch (lts), stretch	1:91.10.0-1~deb9u1	fixed
	buster (security), buster, buster (lts)	1:115.12.0-1~deb10u1	fixed
	bullseye	1:115.12.0-1~deb11u1	fixed
	bullseye (security)	1:115.15.0-1~deb11u1	fixed
	bookworm	1:115.12.0-1~deb12u1	fixed
	bookworm (security)	1:115.15.0-1~deb12u1	fixed
	sid, trixie	1:128.1.1esr-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
firefox	source	(unstable)	96.0-1
firefox-esr	source	jessie	(unfixed)	end-of-life
firefox-esr	source	stretch	91.5.0esr-1~deb9u1		DLA-2880-1
firefox-esr	source	buster	91.5.0esr-1~deb10u1		DSA-5044-1
firefox-esr	source	bullseye	91.5.0esr-1~deb11u1		DSA-5044-1
firefox-esr	source	(unstable)	91.5.0esr-1
nss	source	jessie	2:3.26-1+debu8u16		ELA-550-1
nss	source	stretch	2:3.26.2-1.1+deb9u5		DLA-2898-1
nss	source	buster	2:3.42.1-1+deb10u5		DSA-5062-1
nss	source	bullseye	2:3.61-1+deb11u2		DSA-5062-1
nss	source	(unstable)	2:3.73-1
thunderbird	source	jessie	(unfixed)	end-of-life
thunderbird	source	stretch	1:91.5.0-1~deb9u1		DLA-2881-1
thunderbird	source	buster	1:91.5.0-2~deb10u1		DSA-5045-1
thunderbird	source	bullseye	1:91.5.0-2~deb11u1		DSA-5045-1
thunderbird	source	(unstable)	1:91.5.0-1

Notes

https://www.mozilla.org/en-US/security/advisories/mfsa2022-01/#CVE-2022-22747
https://www.mozilla.org/en-US/security/advisories/mfsa2022-02/#CVE-2022-22747
https://www.mozilla.org/en-US/security/advisories/mfsa2022-03/#CVE-2022-22747
https://bugzilla.mozilla.org/show_bug.cgi?id=1735028
https://hg.mozilla.org/projects/nss/rev/7ff99e71f3e37faed12bc3cc90a3eed27e3418d0