Vulnerability CVE-2021-23961

Vulnerability Name:

CVE-2021-23961 (CCN-195649)

Assigned:

2021-01-26

Published:

2021-01-26

Updated:

2022-05-27

Summary:

Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox < 85.

CVSS v3 Severity:

7.4 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N)
6.4 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

7.4 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N)
6.4 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-noinfo
CWE-200

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2021-23961

Source: MISC
Type: Issue Tracking, Permissions Required, Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1677940

Source: XF
Type: UNKNOWN
firefox-cve202123961-info-disc(195649)

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20210422 [SECURITY] [DLA 2632-1] thunderbird security update

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20210423 [SECURITY] [DLA 2633-1] firefox-esr security update

Source: GENTOO
Type: Third Party Advisory
GLSA-202104-09

Source: GENTOO
Type: Third Party Advisory
GLSA-202104-10

Source: DEBIAN
Type: Third Party Advisory
DSA-4895

Source: DEBIAN
Type: Third Party Advisory
DSA-4897

Source: CCN
Type: IBM Security Bulletin 6454029 (Cloud Pak for Multicloud Management)
Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud Pak for Multicloud Management Monitoring

Source: CCN
Type: Mozilla Foundation Security Advisory 2021-03
Security Vulnerabilities fixed in Firefox 85

Source: MISC
Type: Release Notes, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-03/

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2021-23961

Vulnerable Configuration:

Configuration 1:

cpe:/a:mozilla:firefox:*:*:*:*:*:*:*:* (Version < 85.0)

Configuration 2:

cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration RedHat 1:

cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:*

Configuration RedHat 3:

cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*

Configuration RedHat 4:

cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*

Configuration RedHat 5:

cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

Configuration RedHat 6:

cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:7868	P	MozillaFirefox-102.11.0-150200.152.87.1 on GA media (Moderate)	2023-06-12
oval:org.opensuse.security:def:645	P	Security update for php7 (Moderate) (in QA)	2022-10-04
oval:org.opensuse.security:def:3546	P	libICE6-1.0.8-12.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3252	P	libsmi-0.4.8-18.55 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:94765	P	p7zip-16.02-14.7.1 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:94882	P	MozillaFirefox-91.8.0-150200.152.26.1 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:95217	P	libwebp6-0.5.0-3.5.1 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:95176	P	MozillaThunderbird-91.8.0-150200.8.65.1 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:111899	P	MozillaFirefox-92.0-1.2 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:111905	P	MozillaThunderbird-91.1.1-1.1 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:99443	P	(Moderate)	2021-12-16
oval:org.opensuse.security:def:101930	P	Security update for the Linux Kernel (Important)	2021-11-16
oval:org.opensuse.security:def:1639	P	Security update for squid (Moderate)	2021-10-20
oval:org.opensuse.security:def:105476	P	MozillaFirefox-92.0-1.2 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:105478	P	MozillaThunderbird-91.1.1-1.1 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:101134	P	MozillaFirefox-78.10.0-8.38.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:72447	P	MozillaFirefox-78.10.0-8.38.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62728	P	MozillaFirefox-78.10.0-8.38.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:101478	P	Security update for bluez (Moderate)	2021-07-22
oval:org.opensuse.security:def:99642	P	(Moderate)	2021-06-04
oval:org.opensuse.security:def:99949	P	(Important)	2021-06-01
oval:org.opensuse.security:def:111358	P	Security update for MozillaThunderbird (Important)	2021-05-01
oval:org.opensuse.security:def:108596	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:75826	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:93197	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:9494	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:91904	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:102973	P	Security update for MozillaThunderbird (Important)	2021-04-29
oval:org.opensuse.security:def:66758	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:99049	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:10639	P	Security update for MozillaThunderbird (Important)	2021-04-29
oval:org.opensuse.security:def:92692	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:8743	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:70206	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:109639	P	Security update for MozillaThunderbird (Important)	2021-04-29
oval:org.opensuse.security:def:9693	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:92099	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:69452	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:99244	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:92891	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:96911	P	Security update for MozillaThunderbird (Important)	2021-04-29
oval:org.opensuse.security:def:8938	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:70384	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:119779	P	Security update for MozillaThunderbird (Important)	2021-04-29
oval:org.opensuse.security:def:10066	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:92294	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:5669	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:69634	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:93044	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:96912	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:9312	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:70779	P	Security update for MozillaThunderbird (Important)	2021-04-29
oval:org.opensuse.security:def:98854	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:96301	P	Security update for MozillaThunderbird (Important)	2021-04-29
oval:org.opensuse.security:def:10244	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:92493	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:8567	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:69833	P	Security update for MozillaFirefox (Important)	2021-04-29
oval:org.opensuse.security:def:41157	P	Security update for MozillaFirefox (Important)	2021-04-28
oval:org.opensuse.security:def:43088	P	Security update for MozillaFirefox (Important)	2021-04-28
oval:org.opensuse.security:def:38658	P	Security update for MozillaFirefox (Important)	2021-04-28
oval:org.opensuse.security:def:44378	P	Security update for MozillaFirefox (Important)	2021-04-28
oval:org.opensuse.security:def:39948	P	Security update for MozillaFirefox (Important)	2021-04-28
oval:org.opensuse.security:def:45587	P	Security update for MozillaFirefox (Important)	2021-04-28
oval:org.opensuse.security:def:26036	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:55888	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:84130	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:5023	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:31155	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:57897	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:86538	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:51541	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:82558	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:126692	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:33638	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:60239	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:89116	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:29351	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:56008	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:84587	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:31610	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:58727	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:87368	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:23553	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:51876	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:83272	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:127089	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:33896	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:89374	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:30065	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:56978	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:85619	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:32074	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:59461	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:88105	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:23888	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:55174	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:83392	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:34416	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:30185	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:57433	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:86074	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:125521	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:32904	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:59719	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:org.opensuse.security:def:88417	P	Security update for MozillaFirefox (Important)	2021-04-27
oval:com.redhat.rhsa:def:20211350	P	RHSA-2021:1350: thunderbird security update (Important)	2021-04-26
oval:com.redhat.rhsa:def:20211353	P	RHSA-2021:1353: thunderbird security update (Important)	2021-04-26
oval:org.opensuse.security:def:111347	P	Security update for MozillaFirefox (Important)	2021-04-26
oval:com.redhat.rhsa:def:20211360	P	RHSA-2021:1360: firefox security update (Important)	2021-04-26
oval:com.redhat.rhsa:def:20211363	P	RHSA-2021:1363: firefox security update (Important)	2021-04-26
oval:org.opensuse.security:def:96870	P	Security update for MozillaFirefox (Important)	2021-04-23
oval:org.opensuse.security:def:117658	P	Security update for MozillaFirefox (Important)	2021-04-23
oval:org.opensuse.security:def:4120	P	Security update for MozillaFirefox (Important)	2021-04-23
oval:org.opensuse.security:def:108144	P	Security update for MozillaFirefox (Important)	2021-04-23
oval:org.opensuse.security:def:74277	P	Security update for MozillaFirefox (Important)	2021-04-23
oval:org.opensuse.security:def:65209	P	Security update for MozillaFirefox (Important)	2021-04-23

BACK