PT-2021-5350 · Mozilla+9 · Firefox Esr+11

Armin Ebert · Published 2021-12-07 · Updated 2024-12-12 · CVE-2021-43543

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Thunderbird versions prior to 91.4.0 Mozilla Firefox ESR versions prior to 91.4.0 Mozilla Firefox versions prior to 95

Description The issue is related to errors in security settings, specifically in the handling of Content Security Policy (CSP) by Mozilla Firefox and Mozilla Thunderbird. This could allow a remote attacker to bypass existing security restrictions by embedding additional content into documents, thus escaping the sandbox's script restrictions.

Recommendations For Mozilla Thunderbird versions prior to 91.4.0, update to version 91.4.0 or later. For Mozilla Firefox ESR versions prior to 91.4.0, update to version 91.4.0 or later. For Mozilla Firefox versions prior to 95, update to version 95 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-254

Related Identifiers

ALSA-2021:5013

ALSA-2021:5045

ALT-PU-2021-3493

ALT-PU-2021-3496

ALT-PU-2021-3506

ALT-PU-2021-3510

ALT-PU-2021-3533

ALT-PU-2021-3541

ALT-PU-2021-3576

ALT-PU-2021-3582

ALT-PU-2022-1781

ALT-PU-2022-1783

ALT-PU-2022-2458

ALT-PU-2022-2929

ALT-PU-2023-1138

ALT-PU-2023-1139

ALT-PU-2023-4336

ALT-PU-2023-4339

BDU:2021-06180

CESA-2021_5013

CESA-2021_5014

CESA-2021_5045

CVE-2021-43543

DLA-2863-1

DLA-2874-1

DSA-5026-1

DSA-5034-1

MGASA-2021-0551

MGASA-2021-0554

OESA-2023-1673

OESA-2023-1674

OPENSUSE-SU-2021:1575-1

OPENSUSE-SU-2021:1635-1

OPENSUSE-SU-2021:3993-1

OPENSUSE-SU-2021:4150-1

OPENSUSE-SU-2021_1575-1

OPENSUSE-SU-2021_1635-1

OPENSUSE-SU-2021_3993-1

OPENSUSE-SU-2021_4150-1

OPENSUSE-SU-2024:11669-1

OPENSUSE-SU-2024:11670-1

OPENSUSE-SU-2024:14572-1

RHSA-2021:5013

RHSA-2021:5014

RHSA-2021:5015

RHSA-2021:5016

RHSA-2021:5017

RHSA-2021:5045

RHSA-2021:5046

RHSA-2021:5047

RHSA-2021:5048

RHSA-2021:5055

RHSA-2021_5013

RHSA-2021_5014

RHSA-2021_5045

RHSA-2021_5046

RLSA-2021:5013

RLSA-2021:5045

SUSE-SU-2021:14859-1

SUSE-SU-2021:3993-1

SUSE-SU-2021:3995-1

SUSE-SU-2021:4000-1

SUSE-SU-2021:4150-1

SUSE-SU-2021_14859-1

USN-5186-1

USN-5186-2

USN-5246-1

USN-5248-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Firefox

Firefox Esr

Thunderbird

Red Hat

Rocky Linux

Suse

Ubuntu

References · 2320

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_jit_use_after_free.rb · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-1802 · Exploit
• 🔥 https://github.com/0vercl0k/CVE-2022-28281 · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-26485 · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥❌ https://github.com/Pwnrin/CVE-2022-28282 · Exploit, Deleted
• 🔥❌ https://github.com/MagicPwnrin/CVE-2022-28282 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2022-34471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-34479 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-26976 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4047 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-43543 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44538 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38473 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-28289 · Security Note