A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93, Thunderbird < 91.3, and Firefox ESR < 91.3.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-thunderbirdalpine-linux-upgrade-firefox | Aug 22, 2024 | Dec 8, 2021 | |
| Centos_linux | — | centos-upgrade-firefoxcentos-upgrade-firefox-debuginfocentos-upgrade-firefox-debugsourcecentos-upgrade-thunderbirdcentos-upgrade-thunderbird-debuginfocentos-upgrade-thunderbird-debugsource | Feb 28, 2022 | Dec 8, 2021 |
| Debian | debian-upgrade-firefox-esrdebian-upgrade-thunderbird | Dec 30, 2021 | Dec 8, 2021 | |
| Mfsa2021 43 | mozilla-firefox-upgrade-93_0 | Dec 8, 2021 | Oct 5, 2021 | |
| Mfsa2021 49 | mozilla-firefox-esr-upgrade-91_3 | Dec 8, 2021 | Nov 2, 2021 | |
| Mozilla Thunderbird | mozilla-thunderbird-upgrade-91_3 | Dec 8, 2021 | Nov 3, 2021 | |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-firefoxredhat-upgrade-firefox-debuginforedhat-upgrade-firefox-debugsourceredhat-upgrade-thunderbirdredhat-upgrade-thunderbird-debuginforedhat-upgrade-thunderbird-debugsource | Feb 28, 2022 | Dec 8, 2021 | |
| Rocky_linux | rocky-upgrade-firefoxrocky-upgrade-firefox-debuginforocky-upgrade-firefox-debugsourcerocky-upgrade-thunderbirdrocky-upgrade-thunderbird-debuginforocky-upgrade-thunderbird-debugsource | Mar 12, 2024 | Dec 8, 2021 | |
| Ubuntu | ubuntu-upgrade-thunderbird | Jan 22, 2022 | Dec 8, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub