Unrated severityNVD Advisory· Published Dec 8, 2021· Updated Aug 4, 2024
CVE-2021-38506
CVE-2021-38506
Description
Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
Affected products
39- osv-coords36 versionspkg:rpm/almalinux/firefoxpkg:rpm/almalinux/thunderbirdpkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweedpkg:rpm/suse/MozillaFirefox&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%206pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP2pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP3pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCLpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP2pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP3
< 91.3.0-1.el8_4.alma+ 35 more
- (no CPE)range: < 91.3.0-1.el8_4.alma
- (no CPE)range: < 91.3.0-2.el8_4.alma
- (no CPE)range: < 128.5.1-1.1
- (no CPE)range: < 91.3.0-152.6.1
- (no CPE)range: < 94.0.1-1.1
- (no CPE)range: < 91.4.0-lp152.2.52.1
- (no CPE)range: < 91.4.0-8.45.2
- (no CPE)range: < 91.3.0-1.1
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-152.6.1
- (no CPE)range: < 91.3.0-152.6.1
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-150.6.1
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.3.0-112.80.2
- (no CPE)range: < 91.4.0-8.45.2
- (no CPE)range: < 91.4.0-8.45.2
- Range: unspecified
- Range: unspecified
- Range: unspecified
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
10- security.gentoo.org/glsa/202202-03mitrevendor-advisoryx_refsource_GENTOO
- security.gentoo.org/glsa/202208-14mitrevendor-advisoryx_refsource_GENTOO
- www.debian.org/security/2021/dsa-5026mitrevendor-advisoryx_refsource_DEBIAN
- www.debian.org/security/2022/dsa-5034mitrevendor-advisoryx_refsource_DEBIAN
- bugzilla.mozilla.org/show_bug.cgimitrex_refsource_MISC
- lists.debian.org/debian-lts-announce/2021/12/msg00030.htmlmitremailing-listx_refsource_MLIST
- lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlmitremailing-listx_refsource_MLIST
- www.mozilla.org/security/advisories/mfsa2021-48/mitrex_refsource_MISC
- www.mozilla.org/security/advisories/mfsa2021-49/mitrex_refsource_MISC
- www.mozilla.org/security/advisories/mfsa2021-50/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.