Cloudanix VulnDB

CVE-2021-43534

High · 8.8

CVSS

8.8

EPSS

1.2%

Published

Dec 8, 2021

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in older versions of Firefox and Thunderbird could let attackers who trick a user into opening a malicious web page or email take over the computer.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Remote Code Execution
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Multiple memory safety bugs in the browser engine result in memory corruption that can be leveraged for arbitrary code execution.

Why it matters to the business

Attackers can take full control of affected user systems, leading to data theft, ransomware deployment, or use of the machine for further attacks; the issue affects widely deployed desktop software across many organizations.

How an attack unfolds

An attacker crafts specially formed web content or email that triggers one of the memory corruption conditions during parsing or rendering; with sufficient effort the corruption is turned into code execution inside the browser or mail client process.

How to fix it

Upgrade Firefox to version 94 or later, Firefox ESR to 91.3 or later, and Thunderbird to 91.3 or later; apply the corresponding operating-system package updates when available.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases listed above; re-test by loading known-good content and verifying no crash or unexpected behavior occurs under the previously vulnerable builds.

Typical attack path

  1. Attacker hosts malicious HTML, JavaScript, or email attachment on a web server or sends it via email
  2. Victim opens the content in an affected Firefox, Firefox ESR, or Thunderbird version
  3. Memory corruption occurs during content processing
  4. Attacker payload achieves arbitrary native code execution within the process

How to detect it

Review browser and mail-client crash logs for unusual memory-related faults around the time of suspected incidents; correlate with web-proxy or mail-server logs showing visits to unknown domains or receipt of suspicious messages immediately preceding process anomalies.

What your security team should do

  • Prioritize immediate update of all Firefox, ESR, and Thunderbird installations to the fixed versions
  • Block or sandbox older browser and mail-client versions through endpoint management until patched
  • Monitor vulnerability disclosure feeds for any newly published exploit code

The record

Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

Affected packages

Ecosystem Package Introduced Fixed
Debian:10 thunderbird 0 1:91.4.1-1~deb10u1
Debian:11 firefox-esr 0 91.4.1esr-1~deb11u1
Debian:11 thunderbird 0 1:91.4.1-1~deb11u1
Debian:12 firefox-esr 0 91.3.0esr-1
Debian:12 thunderbird 0 1:91.3.0-1
Debian:13 firefox-esr 0 91.3.0esr-1
Debian:13 thunderbird 0 1:91.3.0-1
Debian:9 firefox-esr 0 91.4.1esr-1~deb9u1
Debian:9 thunderbird 0 1:91.4.1-1~deb9u1
Mageia:8 firefox 0 91.3.0-1.mga8
Mageia:8 firefox-l10n 0 91.3.0-1.mga8
Mageia:8 nss 0 3.72.0-1.mga8
Mageia:8 thunderbird 0 91.3.0-1.mga8
Mageia:8 thunderbird-l10n 0 91.3.0-1.mga8
Red Hat:enterprise_linux:7::client firefox 0 0:91.3.0-1.el7_9
Red Hat:enterprise_linux:7::client firefox-debuginfo 0 0:91.3.0-1.el7_9
Red Hat:enterprise_linux:7::client thunderbird 0 0:91.3.0-2.el7_9
Red Hat:enterprise_linux:7::client thunderbird-debuginfo 0 0:91.3.0-2.el7_9
Red Hat:enterprise_linux:7::server firefox 0 0:91.3.0-1.el7_9
Red Hat:enterprise_linux:7::server firefox-debuginfo 0 0:91.3.0-1.el7_9
Red Hat:enterprise_linux:7::server thunderbird 0 0:91.3.0-2.el7_9
Red Hat:enterprise_linux:7::server thunderbird-debuginfo 0 0:91.3.0-2.el7_9
Red Hat:enterprise_linux:7::workstation firefox 0 0:91.3.0-1.el7_9
Red Hat:enterprise_linux:7::workstation firefox-debuginfo 0 0:91.3.0-1.el7_9
Red Hat:enterprise_linux:7::workstation thunderbird 0 0:91.3.0-2.el7_9
Red Hat:enterprise_linux:7::workstation thunderbird-debuginfo 0 0:91.3.0-2.el7_9
Red Hat:enterprise_linux:8::appstream firefox 0 0:91.3.0-1.el8_4
Red Hat:enterprise_linux:8::appstream firefox-debuginfo 0 0:91.3.0-1.el8_4
Red Hat:enterprise_linux:8::appstream firefox-debugsource 0 0:91.3.0-1.el8_4
Red Hat:enterprise_linux:8::appstream thunderbird 0 0:91.3.0-2.el8_4
Red Hat:enterprise_linux:8::appstream thunderbird-debuginfo 0 0:91.3.0-2.el8_4
Red Hat:enterprise_linux:8::appstream thunderbird-debugsource 0 0:91.3.0-2.el8_4
Red Hat:rhel_eus:8.1::appstream firefox 0 0:91.3.0-1.el8_1
Red Hat:rhel_eus:8.1::appstream firefox-debuginfo 0 0:91.3.0-1.el8_1
Red Hat:rhel_eus:8.1::appstream firefox-debugsource 0 0:91.3.0-1.el8_1
Red Hat:rhel_eus:8.1::appstream thunderbird 0 0:91.3.0-2.el8_1
Red Hat:rhel_eus:8.1::appstream thunderbird-debuginfo 0 0:91.3.0-2.el8_1
Red Hat:rhel_eus:8.1::appstream thunderbird-debugsource 0 0:91.3.0-2.el8_1
Red Hat:rhel_eus:8.2::appstream firefox 0 0:91.3.0-1.el8_2
Red Hat:rhel_eus:8.2::appstream firefox-debuginfo 0 0:91.3.0-1.el8_2
Red Hat:rhel_eus:8.2::appstream firefox-debugsource 0 0:91.3.0-1.el8_2
Red Hat:rhel_eus:8.2::appstream thunderbird 0 0:91.3.0-2.el8_2
Red Hat:rhel_eus:8.2::appstream thunderbird-debuginfo 0 0:91.3.0-2.el8_2
Red Hat:rhel_eus:8.2::appstream thunderbird-debugsource 0 0:91.3.0-2.el8_2
Rocky Linux:8 firefox 0 0:91.3.0-1.el8
Rocky Linux:8 thunderbird 0 0:91.3.0-2.el8_4
Ubuntu:18.04:LTS firefox 0 94.0+build3-0ubuntu0.18.04.1
Ubuntu:18.04:LTS thunderbird 0 1:91.5.0+build1-0ubuntu0.18.04.1
Ubuntu:20.04:LTS firefox 0 94.0+build3-0ubuntu0.20.04.1
Ubuntu:20.04:LTS thunderbird 0 1:91.5.0+build1-0ubuntu0.20.04.1
Ubuntu:22.04:LTS firefox 0 94.0+build3-0ubuntu1
Ubuntu:22.04:LTS thunderbird 0 1:91.3.1+build1-0ubuntu1

Related vulnerabilities