The vulnerability in Mozilla Firefox, Firefox ESR, and the email client Thunderbird arises from incorrect handling of zero bytes or NULL values during data exchange. This allows an attacker to exploit their privileges or cause service failures.

🗓️ 20 Apr 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Firefox, Firefox ESR, and Thunderbird have zero-byte handling vulnerabilities during data exchange that enable privilege escalation.

Reporter	Title	Published	Views	Family All 182
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Mozilla Firefox affect IBM Cloud Pak for Multicloud Management Monitoring	18 May 202111:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 78.9.0 ESR + CVE-2021-23954) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF13 + CP4MCM2.2	12 May 202102:42	–	ibm
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 78.7.0-alt1	27 Jan 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 78.7.0-alt1	26 Jan 202100:00	–	altlinux
Tenable Nessus	Amazon Linux 2 : thunderbird (ALAS-2021-1603)	19 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 8 : firefox (CESA-2021:0288)	1 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 8 : thunderbird (CESA-2021:0298)	1 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 7 : firefox (RHSA-2021:0290)	9 Oct 202400:00	–	nessus
Tenable Nessus	CentOS 7 : thunderbird (RHSA-2021:0297)	9 Oct 202400:00	–	nessus
Tenable Nessus	Debian DLA-2539-1 : firefox-esr security update	4 Feb 202100:00	–	nessus

Vulners

Node

mozilla firefoxRange<85

OR

mozilla firefox_esrRange<78.7

OR

mozilla thunderbirdRange<78.7

OR

red_hat red_hat_enterprise_linuxMatch7

OR

red_hat red_hat_enterprise_linuxMatch8

OR

novell opensuse_leapMatch15.1

OR

novell opensuse_leapMatch15.2

Source	Link
access	www.access.redhat.com/security/cve/cve-2021-23960
bugzilla	www.bugzilla.mozilla.org/show_bug.cgi
lists	www.lists.opensuse.org/archives/list/[email protected]/thread/LV6TQVT6324Y5SWHTL34EKZT7PFDOYE4/
lists	www.lists.opensuse.org/archives/list/[email protected]/thread/PYQVYICIBRGAYRG5HERVZ2YG2FAQSVAR/
redos	www.redos.red-soft.ru/updatesec/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2021-23960
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti
mozilla	www.mozilla.org/security/advisories/mfsa2021-03/
mozilla	www.mozilla.org/security/advisories/mfsa2021-04/
mozilla	www.mozilla.org/security/advisories/mfsa2021-05/

16 Sep 2024 00:00Current

7.7High risk

Vulners AI Score7.7

CVSS 38.8

CVSS 210

EPSS0.00285

firefox thunderbird zero byte handling data exchange privilege escalation service failures