{"uuid": "07698bc4-f21b-4091-a5d0-41a9ba0618ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23997", "type": "seen", "source": "https://t.me/hacking_Attack/5839", "content": "Black Hat Ethical Hacking\nMozilla Fixes Firefox Flaw That Allowed Spoofing of HTTPS Browser Padlock\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Mozilla Fixes Firefox Flaw That Allowed Spoofing of HTTPS Browser PadlockPost Views: 56 \nReading Time: 1 Minute\nThe Mozilla Foundation fixed a flaw in its Firefox browser that allowed spoofing of the HTTPS secure communications icon, displayed as a padlock in the browser address window. Successful exploitation of the flaw could have allowed a rogue website to intercept browser communications. \nThe Mozilla Foundation releases Firefox 88, fixing 13 bugs ranging from high to low severity.\nThe patch was part of the non-profit\u2019s Monday update to Firefox 88 and its corporate Firefox ESR 78.10 browser and its Thunderbird 78.10 email client. In total, Firefox 88 addresses 13 browser bugs, six of which are rated high-severity. Padlock Bug: False Sense of SecurityTracked as CVE-2021-23998, the secure-lock-icon bug effects both the consumer and corporate versions of Firefox browsers prior to the Monday releases. \u201cThrough complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page,\u201d wrote Mozilla in its security advisory.\nCredited for discovering the spoofed secure lock icon is independent researcher Jordi Chancel, who on December 10, 2020 tweeted\u00a0\u201cI discovered again a new SSL Spoofing Issue (and others variohttps://www.mozilla.org/en-US/security/advisories/mfsa2021-16/#CVE-2021-23998us security issues last 2 months)\u201d. The vulnerability has a severity rating of moderate, Mozilla reported.\nSee Also: NitroRansomware Asks for Discord Gift Codes, Steals Access Tokens The browser padlock icon, used by all major browsers,\u00a0indicates a secure\u00a0communication channel between the\u00a0browser\u00a0and the server hosting the website. It indicates the communication is encrypted using HTTPS and utilizes an SSL/TLS certificate. Six High-Severity BugsOther bugs, rated high-severity, are flaws ranging from memory corruption bugs to one that allowed a rogue website to render a malicious JavaScript outside a webpage\u2019s visible content window.\n\n\u201cBy utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage\u2019s viewport, resulting in a spoofing attack that could have been used for phishing or other attacks on a user,\u201d Mozilla wrote of the bug tracked as CVE-2021-23996.\n\nBug hunter Irvan Kurniawan is credited for unearthing two of the high-severity bugs and one moderate flaw fixed in Firefox Monday. One is (CVE-2021-23995) is a bug described as a \u201cuse-after-free in responsive design mode\u201d.\nSee Also: Offensive Security Tool: Hunt\n\u201cWhen Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been exploited to run arbitrary code,\u201d wrote Mozilla. Responsive design is a term used to describe how websites automatically adapt to different sized screens\n\nKurniawan is also credited for finding a use-after-free bug (CVE-2021-23997) that can be triggered by the releasing of a web-based font from the browser\u2019s cache. This bug, like Kurniawan\u2019s previous vulnerability, could be uses by an adversary to target a specific browser and execute remote code.\n\n\u201cDue to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We presume that with enough effort this could have been exploited to run arbitrary code,\u201d Mozilla wrote. See Also: Hacking Stories: When two young hackers played war games with PentagonThe Mozilla security bulletin is light on t[...]", "creation_timestamp": "2026-09-01T20:02:46.223198Z"}