PT-2021-4943 · Mozilla+9 · Firefox Esr+11

Irvan Kurniawan · Published 2021-11-02 · Updated 2024-12-12 · CVE-2021-38504

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 94 Thunderbird versions prior to 91.3 Firefox ESR versions prior to 91.3

Description A use-after-free issue could occur when interacting with an HTML input element's file picker dialog with the webkitdirectory attribute set, leading to memory corruption and a potentially exploitable crash. This issue may allow a remote attacker to cause a denial of service.

Recommendations For Firefox versions prior to 94, update to version 94 or later. For Thunderbird versions prior to 91.3, update to version 91.3 or later. For Firefox ESR versions prior to 91.3, update to version 91.3 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2021:4123

ALSA-2021:4130

ALT-PU-2021-3214

ALT-PU-2021-3215

ALT-PU-2021-3226

ALT-PU-2021-3243

ALT-PU-2021-3259

ALT-PU-2021-3369

ALT-PU-2021-3370

ALT-PU-2021-3391

ALT-PU-2022-1781

ALT-PU-2022-1783

ALT-PU-2022-2458

ALT-PU-2022-2929

ALT-PU-2023-1138

ALT-PU-2023-1139

ALT-PU-2023-4336

ALT-PU-2023-4339

BDU:2021-05696

CESA-2021_4116

CESA-2021_4123

CESA-2021_4130

CESA-2021_4134

CVE-2021-38504

DLA-2863-1

DLA-2874-1

DSA-5026-1

DSA-5034-1

MGASA-2021-0505

MGASA-2021-0506

OESA-2023-1673

OESA-2023-1674

OPENSUSE-SU-2021:1635-1

OPENSUSE-SU-2021:3745-1

OPENSUSE-SU-2021:4150-1

OPENSUSE-SU-2021_1635-1

OPENSUSE-SU-2021_3745-1

OPENSUSE-SU-2021_4150-1

OPENSUSE-SU-2024:11607-1

OPENSUSE-SU-2024:11614-1

OPENSUSE-SU-2024:14572-1

RHSA-2021:4116

RHSA-2021:4123

RHSA-2021:4130

RHSA-2021:4132

RHSA-2021:4133

RHSA-2021:4134

RHSA-2021:4605

RHSA-2021:4607

RHSA-2021_4116

RHSA-2021_4123

RHSA-2021_4130

RHSA-2021_4134

RLSA-2021:4123

RLSA-2021:4130

SUSE-SU-2021:3651-1

SUSE-SU-2021:3721-1

SUSE-SU-2021:3745-1

SUSE-SU-2021:4150-1

USN-5131-1

USN-5152-1

USN-5248-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Firefox

Firefox Esr

Linuxmint

Red Hat

Rocky Linux

Suse

Thunderbird

Ubuntu

References · 2302

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_jit_use_after_free.rb · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-1802 · Exploit
• 🔥 https://github.com/0vercl0k/CVE-2022-28281 · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-26485 · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥❌ https://github.com/Pwnrin/CVE-2022-28282 · Exploit, Deleted
• 🔥❌ https://github.com/MagicPwnrin/CVE-2022-28282 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2022-34471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-34479 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-26976 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4047 · Security Note
• https://mozilla.org/security/advisories/mfsa2021-48 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44538 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38473 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-28289 · Security Note