Ubuntu.comUB:CVE-2021-23969CVE-2021-23969
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.008 Low
EPSS
Percentile
81.1%
As specified in the W3C Content Security Policy draft, when creating a
violation report, “User agents need to ensure that the source file is the
URL requested by the page, pre-redirects. If that’s not possible, user
agents need to strip the URL down to an origin to avoid unintentional
leakage.” Under certain types of redirects, Firefox incorrectly set the
source file to be the destination of the redirects. This was fixed to be
the redirect destination’s origin. This vulnerability affects Firefox < 86,
Thunderbird < 78.8, and Firefox ESR < 78.8.
Notes
| Author | Note |
|---|---|
| tyhicks | mozjs contains a copy of the SpiderMonkey JavaScript engine |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | firefox | < 86.0+build3-0ubuntu0.18.04.1 | UNKNOWN |
| ubuntu | 20.04 | noarch | firefox | < 86.0+build3-0ubuntu0.20.04.1 | UNKNOWN |
| ubuntu | 20.10 | noarch | firefox | < 86.0+build3-0ubuntu0.20.10.1 | UNKNOWN |
| ubuntu | 21.04 | noarch | firefox | < 86.0+build3-0ubuntu1 | UNKNOWN |
| ubuntu | 21.10 | noarch | firefox | < 86.0+build3-0ubuntu1 | UNKNOWN |
| ubuntu | 22.04 | noarch | firefox | < 86.0+build3-0ubuntu1 | UNKNOWN |
| ubuntu | 22.10 | noarch | firefox | < 86.0+build3-0ubuntu1 | UNKNOWN |
| ubuntu | 23.04 | noarch | firefox | < 86.0+build3-0ubuntu1 | UNKNOWN |
| ubuntu | 23.10 | noarch | firefox | < 86.0+build3-0ubuntu1 | UNKNOWN |
| ubuntu | 24.04 | noarch | firefox | < 86.0+build3-0ubuntu1 | UNKNOWN |
References
bugzilla.mozilla.org/show_bug.cgi?id=1542194
launchpad.net/bugs/cve/CVE-2021-23969
nvd.nist.gov/vuln/detail/CVE-2021-23969
security-tracker.debian.org/tracker/CVE-2021-23969
ubuntu.com/security/notices/USN-4756-1
ubuntu.com/security/notices/USN-4936-1
www.cve.org/CVERecord?id=CVE-2021-23969
www.mozilla.org/en-US/security/advisories/mfsa2021-07/#CVE-2021-23969
www.mozilla.org/en-US/security/advisories/mfsa2021-08/#CVE-2021-23969
www.mozilla.org/en-US/security/advisories/mfsa2021-09/#CVE-2021-23969
www.mozilla.org/security/advisories/mfsa2021-07/
www.mozilla.org/security/advisories/mfsa2021-08/
www.mozilla.org/security/advisories/mfsa2021-09/
Related
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.008 Low
EPSS
Percentile
81.1%