medium6.5
CVE-2021-43528
Thunderbird unexpectedly enabled JavaScript in the composition area.
Impact
Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with other vulnerabilities. This vulnerability affects Thunderbird < 91.4.0.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Thunderbird | before 91.4.0 |
| Debian | Debian Linux | Versions 9.0, 10.0, 11.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugzilla.mozilla.org/show_bug.cgi?id=1742579
- https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html
- https://security.gentoo.org/glsa/202208-14
- https://www.debian.org/security/2022/dsa-5034
- https://www.mozilla.org/security/advisories/mfsa2021-54/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1742579
- https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html
- https://security.gentoo.org/glsa/202208-14
- https://www.debian.org/security/2022/dsa-5034
- https://www.mozilla.org/security/advisories/mfsa2021-54/