cnvd - cnvd-2021-90093

cnvd-2021-90093

Vulnerability from cnvd

Title: Mozilla Thunderbird缓冲区溢出漏洞（CNVD-2021-90093）

Description:

Mozilla Firefox是美国Mozilla基金会的一款开源Web浏览器。

Mozilla Firefox存在缓冲区溢出漏洞，该漏洞源于软件中存在的内存安全漏洞，其中一些bug显示了内存损坏，攻击者可以利用该漏洞进行任意代码执行。

Severity: 中

Patch Name: Mozilla Thunderbird缓冲区溢出漏洞（CVE-2021-38501）的补丁

Patch Description:

Mozilla Thunderbird是美国Mozilla基金会的一套从Mozilla Application Suite独立出来的电子邮件客户端软件。该软件支持IMAP、POP邮件协议以及HTML邮件格式。 Mozilla Thunderbird存在缓冲区溢出漏洞。该漏洞源于程序处理HTML内容时出现边界错误。远程攻击者可利用该漏洞通过诱骗用户打开特制网页引发内存损坏，并在目标系统上执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://bugzilla.mozilla.org/buglist.cgi?bug_id=1685354%2C1715755%2C1723176

Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-38501

Impacted products

Name
['Mozilla Firefox <93.0', 'Mozilla Thunderbird <91.2', 'Mozilla Firefox ESR <91.2']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-38501",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-38501"
    }
  },
  "description": "Mozilla Firefox\u662f\u7f8e\u56fdMozilla\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u5f00\u6e90Web\u6d4f\u89c8\u5668\u3002\n\nMozilla Firefox\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8f6f\u4ef6\u4e2d\u5b58\u5728\u7684\u5185\u5b58\u5b89\u5168\u6f0f\u6d1e\uff0c\u5176\u4e2d\u4e00\u4e9bbug\u663e\u793a\u4e86\u5185\u5b58\u635f\u574f\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u8fdb\u884c\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://bugzilla.mozilla.org/buglist.cgi?bug_id=1685354%2C1715755%2C1723176",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-90093",
  "openTime": "2021-11-23",
  "patchDescription": "Mozilla Thunderbird\u662f\u7f8e\u56fdMozilla\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u4eceMozilla Application Suite\u72ec\u7acb\u51fa\u6765\u7684\u7535\u5b50\u90ae\u4ef6\u5ba2\u6237\u7aef\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u652f\u6301IMAP\u3001POP\u90ae\u4ef6\u534f\u8bae\u4ee5\u53caHTML\u90ae\u4ef6\u683c\u5f0f\u3002\nMozilla Thunderbird\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u5904\u7406HTML\u5185\u5bb9\u65f6\u51fa\u73b0\u8fb9\u754c\u9519\u8bef\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u8bf1\u9a97\u7528\u6237\u6253\u5f00\u7279\u5236\u7f51\u9875\u5f15\u53d1\u5185\u5b58\u635f\u574f\uff0c\u5e76\u5728\u76ee\u6807\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Mozilla Thunderbird\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CVE-2021-38501\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Mozilla Firefox \u003c93.0",
      "Mozilla Thunderbird \u003c91.2",
      "Mozilla Firefox ESR \u003c91.2"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-38501",
  "serverity": "\u4e2d",
  "submitTime": "2021-10-27",
  "title": "Mozilla Thunderbird\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2021-90093\uff09"
}

CVE-2021-38501 (GCVE-0-2021-38501)

Vulnerability from cvelistv5

Published

2021-11-03 00:02

Modified

2024-08-04 01:44

Severity ?

CWE

Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2

Summary

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2.

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2021-47/	x_refsource_MISC
	https://www.mozilla.org/security/advisories/mfsa2021-45/	x_refsource_MISC
	https://www.mozilla.org/security/advisories/mfsa2021-43/	x_refsource_MISC
	https://bugzilla.mozilla.org/buglist.cgi?bug_id=1685354%2C1715755%2C1723176	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

Mozilla

Firefox

Version: unspecified < 93

	Mozilla	Thunderbird	Version: unspecified < 91.2
	Mozilla	Firefox ESR	Version: unspecified < 91.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:44:22.811Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2021-47/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2021-45/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2021-43/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1685354%2C1715755%2C1723176"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "93",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "91.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "91.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 93, Thunderbird \u003c 91.2, and Firefox ESR \u003c 91.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-03T00:02:56",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2021-47/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2021-45/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2021-43/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1685354%2C1715755%2C1723176"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2021-38501",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "93"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "91.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "91.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 93, Thunderbird \u003c 91.2, and Firefox ESR \u003c 91.2."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2021-47/",
              "refsource": "MISC",
              "url": "https://www.mozilla.org/security/advisories/mfsa2021-47/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2021-45/",
              "refsource": "MISC",
              "url": "https://www.mozilla.org/security/advisories/mfsa2021-45/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2021-43/",
              "refsource": "MISC",
              "url": "https://www.mozilla.org/security/advisories/mfsa2021-43/"
            },
            {
              "name": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1685354%2C1715755%2C1723176",
              "refsource": "MISC",
              "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1685354%2C1715755%2C1723176"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2021-38501",
    "datePublished": "2021-11-03T00:02:56",
    "dateReserved": "2021-08-10T00:00:00",
    "dateUpdated": "2024-08-04T01:44:22.811Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted