PT-2021-4952 · Mozilla+9 · Firefox Esr+11

Armin Ebert · Published 2021-11-02 · Updated 2024-12-12 · CVE-2021-38503

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 94 Thunderbird versions prior to 91.3 Firefox ESR versions prior to 91.3

Description The issue is related to errors in the configuration of sandbox security rules for iframes to XSLT stylesheets. This allows a remote attacker to bypass existing security restrictions by using an iframe to circumvent limitations, such as executing scripts or navigating the top-level frame.

Recommendations For Firefox versions prior to 94, update to version 94 or later to resolve the issue. For Thunderbird versions prior to 91.3, update to version 91.3 or later to resolve the issue. For Firefox ESR versions prior to 91.3, update to version 91.3 or later to resolve the issue.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-254

Related Identifiers

ALSA-2021:4123

ALSA-2021:4130

ALT-PU-2021-3214

ALT-PU-2021-3215

ALT-PU-2021-3226

ALT-PU-2021-3243

ALT-PU-2021-3259

ALT-PU-2021-3369

ALT-PU-2021-3370

ALT-PU-2021-3391

ALT-PU-2022-1781

ALT-PU-2022-1783

ALT-PU-2022-2458

ALT-PU-2022-2929

ALT-PU-2023-1138

ALT-PU-2023-1139

ALT-PU-2023-4336

ALT-PU-2023-4339

BDU:2021-05706

CESA-2021_4116

CESA-2021_4123

CESA-2021_4130

CESA-2021_4134

CVE-2021-38503

DLA-2863-1

DLA-2874-1

DSA-5026-1

DSA-5034-1

MGASA-2021-0505

MGASA-2021-0506

OESA-2023-1673

OESA-2023-1674

OPENSUSE-SU-2021:1635-1

OPENSUSE-SU-2021:3745-1

OPENSUSE-SU-2021:4150-1

OPENSUSE-SU-2021_1635-1

OPENSUSE-SU-2021_3745-1

OPENSUSE-SU-2021_4150-1

OPENSUSE-SU-2024:11607-1

OPENSUSE-SU-2024:11614-1

OPENSUSE-SU-2024:14572-1

RHSA-2021:4116

RHSA-2021:4123

RHSA-2021:4130

RHSA-2021:4132

RHSA-2021:4133

RHSA-2021:4134

RHSA-2021:4605

RHSA-2021:4607

RHSA-2021_4116

RHSA-2021_4123

RHSA-2021_4130

RHSA-2021_4134

RLSA-2021:4123

RLSA-2021:4130

SUSE-SU-2021:3651-1

SUSE-SU-2021:3721-1

SUSE-SU-2021:3745-1

SUSE-SU-2021:4150-1

SUSE-SU-2021_3651-1

SUSE-SU-2021_3721-1

SUSE-SU-2021_3745-1

USN-5131-1

USN-5152-1

USN-5248-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Firefox

Firefox Esr

Linuxmint

Red Hat

Rocky Linux

Suse

Thunderbird

Ubuntu

References · 2302

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_jit_use_after_free.rb · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-1802 · Exploit
• 🔥 https://github.com/0vercl0k/CVE-2022-28281 · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-26485 · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥❌ https://github.com/Pwnrin/CVE-2022-28282 · Exploit, Deleted
• 🔥❌ https://github.com/MagicPwnrin/CVE-2022-28282 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2022-34471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-34479 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-26976 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4047 · Security Note
• https://mozilla.org/security/advisories/mfsa2021-48 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44538 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-38503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38473 · Security Note