medium6.5
CVE-2021-38492
When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers to launch pages and execute scripts in In…
Impact
When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers to launch pages and execute scripts in Internet Explorer in unprivileged mode. *This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 92, Thunderbird < 91.1, Thunderbird < 78.14, Firefox ESR < 78.14, and Firefox ESR < 91.1.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | before 92.0 from 91.0 before 91.1 |
| Mozilla | Firefox Esr | before 78.14 |
| Mozilla | Thunderbird | before 78.14 from 91.0 before 91.1 |
References
- NVD record
- CVE.org record
- https://bugzilla.mozilla.org/show_bug.cgi?id=1721107
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-38/
- https://www.mozilla.org/security/advisories/mfsa2021-39/
- https://www.mozilla.org/security/advisories/mfsa2021-40/
- https://www.mozilla.org/security/advisories/mfsa2021-41/
- https://www.mozilla.org/security/advisories/mfsa2021-42/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1721107
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-38/
- https://www.mozilla.org/security/advisories/mfsa2021-39/
- https://www.mozilla.org/security/advisories/mfsa2021-40/
- https://www.mozilla.org/security/advisories/mfsa2021-41/
- https://www.mozilla.org/security/advisories/mfsa2021-42/