Vulnerability CVE-2021-38506: Information

Description

Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

Severity: MEDIUM (4.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2021-38506
Published: Dec. 9, 2021
Modified: Dec. 9, 2022
Error type identifier: CWE-1021

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus94.0-alt1127.0-alt1ALT-PU-2021-3215-1288748Fixed
firefoxp1094.0-alt1118.0.2-alt0.p10.1ALT-PU-2021-3391-1288832Fixed
firefoxp9105.0.1-alt0.c9.1105.0.1-alt0.c9.1ALT-PU-2023-4339-1319683Fixed
firefoxc10f194.0-alt1112.0.2-alt0.p10.1ALT-PU-2021-3391-1288832Fixed
firefoxc9f2105.0.1-alt0.c9.1105.0.1-alt0.c9.1ALT-PU-2023-1139-1309126Fixed
firefoxp1194.0-alt1126.0.1-alt1ALT-PU-2021-3215-1288748Fixed
firefox-esrsisyphus91.3.0-alt1115.11.0-alt1ALT-PU-2021-3214-1288740Fixed
firefox-esrp1091.3.0-alt1115.11.0-alt1ALT-PU-2021-3243-1288753Fixed
firefox-esrp991.7.0-alt0.p9.1102.11.0-alt0.c9.1ALT-PU-2022-1781-1288073Fixed
firefox-esrc10f191.3.0-alt1115.9.1-alt0.c10.1ALT-PU-2021-3243-1288753Fixed
firefox-esrc9f291.3.0-alt1.c9.1102.12.0-alt0.c9.1ALT-PU-2021-3369-1288792Fixed
firefox-esrp1191.3.0-alt1115.11.0-alt1ALT-PU-2021-3214-1288740Fixed
thunderbirdsisyphus91.3.0-alt1115.9.0-alt1ALT-PU-2021-3226-1288817Fixed
thunderbirdp1091.3.0-alt1115.9.0-alt1ALT-PU-2021-3259-1288818Fixed
thunderbirdp991.6.0-alt0.p9.1102.11.0-alt0.c9.1ALT-PU-2022-1783-1288073Fixed
thunderbirdc10f191.3.0-alt1115.9.0-alt0.c10.1ALT-PU-2021-3259-1288818Fixed
thunderbirdc9f291.3.0-alt0.c9.1102.11.0-alt0.c9.1ALT-PU-2021-3370-1288792Fixed
thunderbirdp1191.3.0-alt1115.9.0-alt1ALT-PU-2021-3226-1288817Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://www.mozilla.org/security/advisories/mfsa2021-50/
  • Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1730750
  • Issue Tracking
  • Permissions Required
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-49/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-48/
  • Vendor Advisory
DSA-5026
  • Third Party Advisory
[debian-lts-announce] 20211229 [SECURITY] [DLA 2863-1] firefox-esr security update
  • Mailing List
  • Third Party Advisory
DSA-5034
  • Third Party Advisory
[debian-lts-announce] 20220104 [SECURITY] [DLA 2874-1] thunderbird security update
  • Mailing List
  • Third Party Advisory
GLSA-202202-03
  • Third Party Advisory
GLSA-202208-14
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
      End excliding
      91.3.0
      cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
      End excliding
      91.3.0
      cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
      End excliding
      94.0

      Configuration 2

      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top