CVE-2021-43538

Name
CVE-2021-43538
Description
By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://www.mozilla.org/security/advisories/mfsa2021-52/
MISC https://www.mozilla.org/security/advisories/mfsa2021-54/
MISC https://www.mozilla.org/security/advisories/mfsa2021-53/
MISC https://bugzilla.mozilla.org/show_bug.cgi?id=1739091
Third Party Advisory https://www.debian.org/security/2021/dsa-5026
MLIST https://lists.debian.org/debian-lts-announce/2021/12/msg00030.html
DEBIAN https://www.debian.org/security/2022/dsa-5034
MLIST https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html
Third Party Advisory https://security.gentoo.org/glsa/202202-03

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* firefox >= None < 95.0
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* firefox_esr >= None < 91.4.0
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* thunderbird >= None < 91.4.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
firefox 3.15-community 94.0-r0 Rasmus Thomsen <oss@cogitri.dev> fixed