6.5

CVE-2021-23975

EPSS 0.29%
Published 26.02.2021 02:15:13
Last modified 21.11.2024 05:52:08
Source security@mozilla.org
Teams watchlist Login
Open Login

The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes. When this function was invoked we incorrectly called the sizeof function, instead of using the API method that checks for invalid pointers. This vulnerability affects Firefox < 86.

Affected products Warnungen 0 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Mozilla ≫ Firefox Version < 86.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.29%	0.518

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://security.gentoo.org/glsa/202104-10

Third Party Advisory

https://www.mozilla.org/security/advisories/mfsa2021-07/

Vendor Advisory

Release Notes

https://bugzilla.mozilla.org/show_bug.cgi?id=1685145

Vendor Advisory

Issue Tracking

Permissions Required

https://nvd.nist.gov/vuln/detail/CVE-2021-23975

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-23975

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-23975

EUVD