VulnerabilityModified
CVE-2021-43543
This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
MEDIUM 6.1EPSS 1.35%
Does this matter?
Lower severity and a low EPSS score (1.35%). Track it; it rarely justifies an emergency change on its own.
Description
Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.35% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- mozilla/firefox · mozilla/firefox esr · mozilla/thunderbird · debian/debian linux
- Source
- security@mozilla.org
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1738418Issue Tracking, Permissions Required, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/12/msg00030.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202202-03Third Party Advisory
- https://security.gentoo.org/glsa/202208-14Third Party Advisory
- https://www.debian.org/security/2021/dsa-5026Third Party Advisory
- https://www.debian.org/security/2022/dsa-5034Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-52/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-53/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-54/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1738418Issue Tracking, Permissions Required, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/12/msg00030.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202202-03Third Party Advisory
- https://security.gentoo.org/glsa/202208-14Third Party Advisory
- https://www.debian.org/security/2021/dsa-5026Third Party Advisory
- https://www.debian.org/security/2022/dsa-5034Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-52/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-53/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-54/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.