critical10.0
CVE-2021-4140
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox.
Impact
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | before 96.0 |
| Mozilla | Firefox Esr | before 91.5 |
| Mozilla | Thunderbird | before 91.5 |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugzilla.mozilla.org/show_bug.cgi?id=1746720
- https://www.mozilla.org/security/advisories/mfsa2022-01/
- https://www.mozilla.org/security/advisories/mfsa2022-02/
- https://www.mozilla.org/security/advisories/mfsa2022-03/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1746720
- https://www.mozilla.org/security/advisories/mfsa2022-01/
- https://www.mozilla.org/security/advisories/mfsa2022-02/
- https://www.mozilla.org/security/advisories/mfsa2022-03/