PT-2021-5347 · Mozilla+9 · Firefox Esr+11

Asumu Takikawa + 1 · Published 2021-12-07 · Updated 2024-12-12 · CVE-2021-43538

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 95 Firefox ESR versions prior to 91.4.0 Thunderbird versions prior to 91.4.0

Description The issue is related to errors in cryptographic transformations and a race condition in notification code. This could allow a remote attacker to hide notifications for pages, potentially leading to spoofing attacks.

Recommendations For Firefox versions prior to 95, update to version 95 or later. For Firefox ESR versions prior to 91.4.0, update to version 91.4.0 or later. For Thunderbird versions prior to 91.4.0, update to version 91.4.0 or later.

Exploit

Fix

UI Misrepresentation of Critical Information

Race Condition

Weakness Enumeration

CWE-451

CWE-362

Related Identifiers

ALSA-2021:5013

ALSA-2021:5045

ALT-PU-2021-3493

ALT-PU-2021-3496

ALT-PU-2021-3506

ALT-PU-2021-3510

ALT-PU-2021-3533

ALT-PU-2021-3541

ALT-PU-2021-3576

ALT-PU-2021-3582

ALT-PU-2022-1781

ALT-PU-2022-1783

ALT-PU-2022-2458

ALT-PU-2022-2929

ALT-PU-2023-1138

ALT-PU-2023-1139

ALT-PU-2023-4336

ALT-PU-2023-4339

BDU:2021-06177

CESA-2021_5013

CESA-2021_5014

CESA-2021_5045

CVE-2021-43538

DLA-2863-1

DLA-2874-1

DSA-5026-1

DSA-5034-1

MGASA-2021-0551

MGASA-2021-0554

OESA-2023-1673

OESA-2023-1674

OPENSUSE-SU-2021:1575-1

OPENSUSE-SU-2021:1635-1

OPENSUSE-SU-2021:3993-1

OPENSUSE-SU-2021:4150-1

OPENSUSE-SU-2021_1575-1

OPENSUSE-SU-2021_1635-1

OPENSUSE-SU-2021_3993-1

OPENSUSE-SU-2021_4150-1

OPENSUSE-SU-2024:11669-1

OPENSUSE-SU-2024:11670-1

OPENSUSE-SU-2024:14572-1

RHSA-2021:5013

RHSA-2021:5014

RHSA-2021:5015

RHSA-2021:5016

RHSA-2021:5017

RHSA-2021:5045

RHSA-2021:5046

RHSA-2021:5047

RHSA-2021:5048

RHSA-2021:5055

RHSA-2021_5013

RHSA-2021_5014

RHSA-2021_5045

RHSA-2021_5046

RLSA-2021:5013

RLSA-2021:5045

SUSE-SU-2021:14859-1

SUSE-SU-2021:3993-1

SUSE-SU-2021:3995-1

SUSE-SU-2021:4000-1

SUSE-SU-2021:4150-1

SUSE-SU-2021_14859-1

USN-5186-1

USN-5186-2

USN-5246-1

USN-5248-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Firefox

Firefox Esr

Linuxmint

Red Hat

Rocky Linux

Suse

Thunderbird

Ubuntu

References · 2320

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_jit_use_after_free.rb · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-1802 · Exploit
• 🔥 https://github.com/0vercl0k/CVE-2022-28281 · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-26485 · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥❌ https://github.com/Pwnrin/CVE-2022-28282 · Exploit, Deleted
• 🔥❌ https://github.com/MagicPwnrin/CVE-2022-28282 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2022-34471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-34479 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-26976 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4047 · Security Note
• https://ubuntu.com/security/CVE-2021-44538 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38473 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-28289 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:4150-1 · Vendor Advisory