CVE-2022-42931
Publication date 27 October 2022
Last updated 25 August 2025
Ubuntu priority
Description
Logins saved by Firefox should be managed by the Password Manager component which uses encryption to save files on-disk. Instead, the username (not password) was saved by the Form Manager to an unencrypted file on disk. This vulnerability affects Firefox < 106.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| firefox | ||
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Fixed 106.0.2+build1-0ubuntu0.20.04.1
|
|
| 18.04 LTS bionic |
Fixed 106.0.2+build1-0ubuntu0.18.04.1
|
|
| 16.04 LTS xenial | Ignored end of standard support | |
| 14.04 LTS trusty | Ignored end of standard support | |
| thunderbird | ||
| 22.04 LTS jammy |
Fixed 1:102.4.2+build2-0ubuntu0.22.04.1
|
|
| 20.04 LTS focal |
Fixed 1:102.4.2+build2-0ubuntu0.20.04.1
|
|
| 18.04 LTS bionic |
Fixed 1:102.4.2+build2-0ubuntu0.18.04.1
|
|
| 16.04 LTS xenial | Ignored end of standard support | |
| 14.04 LTS trusty | Ignored end of standard support |
Notes
mdeslaur
starting with Ubuntu 22.04, the firefox package is just a script that installs the Firefox snap
Severity score breakdown
CVSS version: CVSS v3.0
Base score
3.3 · Low
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
Related Ubuntu Security Notices (USN)
- USN-5709-1
- Firefox vulnerabilities
- 1 November 2022