PT-2021-5351 · Mozilla+9 · Firefox Esr+11

Daniel Veditz · Published 2021-12-07 · Updated 2024-12-12 · CVE-2021-43546

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 91.4.0 Firefox ESR versions prior to 91.4.0 Firefox versions prior to 95

Description The issue is related to cursor spoofing attacks against users with a zoomed native cursor. It may allow a remote attacker to conduct spoofing attacks. The vulnerability is associated with errors in cryptographic transformations.

Recommendations For Thunderbird versions prior to 91.4.0, update to version 91.4.0 or later. For Firefox ESR versions prior to 91.4.0, update to version 91.4.0 or later. For Firefox versions prior to 95, update to version 95 or later.

Exploit

Fix

UI Misrepresentation of Critical Information

Clickjacking

Weakness Enumeration

CWE-451

CWE-1021

Related Identifiers

ALSA-2021:5013

ALSA-2021:5045

ALT-PU-2021-3493

ALT-PU-2021-3496

ALT-PU-2021-3506

ALT-PU-2021-3510

ALT-PU-2021-3533

ALT-PU-2021-3541

ALT-PU-2021-3576

ALT-PU-2021-3582

ALT-PU-2022-1781

ALT-PU-2022-1783

ALT-PU-2022-2458

ALT-PU-2022-2929

ALT-PU-2023-1138

ALT-PU-2023-1139

ALT-PU-2023-4336

ALT-PU-2023-4339

BDU:2021-06181

CESA-2021_5013

CESA-2021_5014

CESA-2021_5045

CVE-2021-43546

DLA-2863-1

DLA-2874-1

DSA-5026-1

DSA-5034-1

MGASA-2021-0551

MGASA-2021-0554

OESA-2023-1673

OESA-2023-1674

OPENSUSE-SU-2021:1575-1

OPENSUSE-SU-2021:1635-1

OPENSUSE-SU-2021:3993-1

OPENSUSE-SU-2021:4150-1

OPENSUSE-SU-2021_1575-1

OPENSUSE-SU-2021_1635-1

OPENSUSE-SU-2021_3993-1

OPENSUSE-SU-2021_4150-1

OPENSUSE-SU-2024:11669-1

OPENSUSE-SU-2024:11670-1

OPENSUSE-SU-2024:14572-1

RHSA-2021:5013

RHSA-2021:5014

RHSA-2021:5015

RHSA-2021:5016

RHSA-2021:5017

RHSA-2021:5045

RHSA-2021:5046

RHSA-2021:5047

RHSA-2021:5048

RHSA-2021:5055

RHSA-2021_5013

RHSA-2021_5014

RHSA-2021_5045

RHSA-2021_5046

RLSA-2021:5013

RLSA-2021:5045

SUSE-SU-2021:14859-1

SUSE-SU-2021:3993-1

SUSE-SU-2021:3995-1

SUSE-SU-2021:4000-1

SUSE-SU-2021:4150-1

SUSE-SU-2021_14859-1

USN-5186-1

USN-5186-2

USN-5246-1

USN-5248-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Firefox

Firefox Esr

Linuxmint

Red Hat

Rocky Linux

Suse

Thunderbird

Ubuntu

References · 2321

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_jit_use_after_free.rb · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-1802 · Exploit
• 🔥 https://github.com/0vercl0k/CVE-2022-28281 · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-26485 · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥❌ https://github.com/Pwnrin/CVE-2022-28282 · Exploit, Deleted
• 🔥❌ https://github.com/MagicPwnrin/CVE-2022-28282 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2022-34471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-34479 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-26976 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4047 · Security Note
• https://ubuntu.com/security/CVE-2021-44538 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38473 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-28289 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:4150-1 · Vendor Advisory