CVE-2021-4128 — Use After Free in Mozilla Firefox

CWE-416 — Use After Free4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 53.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxDebian Firefox
Timeline
PublishedDec 22

Description

When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory corruption and a potentially exploitable crash.*This bug only affects Firefox on MacOS. Other operating systems are unaffected.*. This vulnerability affects Firefox < 95.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5mozilla/firefoxunspecified — 95
▶NVDmozilla/firefox< 95.0
▶mozillamozilla/firefox

Patches

Patch: bugzilla.mozilla.org ↗Patch: bugzilla.mozilla.org ↗

🔴Vulnerability Details

1
GHSA
GHSA-qx74-qh3q-h8rj: When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory corruption and a potentially expl↗2022-12-22
▶

📋Vendor Advisories

2
Debian
CVE-2021-4128: firefox - When transitioning in and out of fullscreen mode, a graphics object was not corr...↗2021
▶
Mozilla
Mozilla Foundation Security Advisory 2021-52: CVE-2021-4128↗
▶