PT-2021-4399 · Mozilla+8 · Firefox Esr+10
Yangkang
·
Published
2021-10-05
·
Updated
2024-12-12
·
CVE-2021-38496
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Thunderbird versions prior to 91.2
Thunderbird versions prior to 78.15
Firefox ESR versions prior to 91.2
Firefox ESR versions prior to 78.15
Firefox versions prior to 93
Description
The issue is related to operations on MessageTasks, where a task may be removed while still scheduled, leading to memory corruption and a potentially exploitable crash. This is also associated with a memory release error. Exploitation of this issue could allow a remote attacker to execute arbitrary code in the system.
Recommendations
For Thunderbird versions prior to 91.2, update to version 91.2 or later.
For Thunderbird versions prior to 78.15, update to version 78.15 or later.
For Firefox ESR versions prior to 91.2, update to version 91.2 or later.
For Firefox ESR versions prior to 78.15, update to version 78.15 or later.
For Firefox versions prior to 93, update to version 93 or later.
Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Centos
Firefox
Firefox Esr
Linuxmint
Red Hat
Rocky Linux
Suse
Thunderbird
Ubuntu