CVEvulnerability
CVE-2021-43538
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-12-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-362
Description
By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
Affected configurations
• mozilla firefox (< 95.0)
• mozilla firefox esr (< 91.4.0)
• mozilla thunderbird (< 91.4.0)
• debian debian linux 9.0
• debian debian linux 10.0
• debian debian linux 11.0
Related
Weakness · CWE (1)
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1739091 Issue Tracking, Permissions Required, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/12/msg00030.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202202-03 Third Party Advisory
- https://security.gentoo.org/glsa/202208-14 Third Party Advisory
- https://www.debian.org/security/2021/dsa-5026 Third Party Advisory
- https://www.debian.org/security/2022/dsa-5034 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-52/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-53/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-54/ Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1739091 Issue Tracking, Permissions Required, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/12/msg00030.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202202-03 Third Party Advisory
- https://security.gentoo.org/glsa/202208-14 Third Party Advisory
- https://www.debian.org/security/2021/dsa-5026 Third Party Advisory
- https://www.debian.org/security/2022/dsa-5034 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-52/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-53/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2021-54/ Vendor Advisory