high7.5
CVE-2021-36773
uBlock Origin before 1.36.2 and nMatrix before 4.4.9 support an arbitrary depth of parameter nesting for strict blocking, which allows crafted web sites to cau…
Impact
uBlock Origin before 1.36.2 and nMatrix before 4.4.9 support an arbitrary depth of parameter nesting for strict blocking, which allows crafted web sites to cause a denial of service (unbounded recursion that can trigger memory consumption and a loss of all blocking functionality).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sciruby | Nmatrix | before 4.4.9 |
| Ublockorigin | Ublock Origin | before 1.36.2 |
| Umatrix Project | Umatrix | before 1.4.2 |
| Debian | Debian Linux | Version 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adoc
- https://lists.debian.org/debian-lts-announce/2022/06/msg00024.html
- https://news.ycombinator.com/item?id=27833752
- https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adoc
- https://lists.debian.org/debian-lts-announce/2022/06/msg00024.html
- https://news.ycombinator.com/item?id=27833752