If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
References
Link | Resource |
---|---|
https://bugzilla.mozilla.org/show_bug.cgi?id=1691153 | Exploit Issue Tracking Vendor Advisory |
https://www.mozilla.org/security/advisories/mfsa2021-14/ | Release Notes Vendor Advisory |
https://www.mozilla.org/security/advisories/mfsa2021-15/ | Release Notes Vendor Advisory |
https://www.mozilla.org/security/advisories/mfsa2021-16/ | Release Notes Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mozilla
Published: 2021-06-24T13:25:15
Updated: 2021-06-24T13:25:15
Reserved: 2021-01-13T00:00:00
Link: CVE-2021-23999
JSON object: View
NVD Information
Status : Analyzed
Published: 2021-06-24T14:15:09.477
Modified: 2022-04-26T15:31:31.837
Link: CVE-2021-23999
JSON object: View
Redhat Information
No data.