CVE-2021-23975 - The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes

Back Back to CVE browser

MEDIUM

The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes

Published Feb 26, 2021

6.5

MEDIUM

CVSS 3.1

EPSS 1.01%

Description

The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes. When this function was invoked we incorrectly called the sizeof function, instead of using the API method that checks for invalid pointers. This vulnerability affects Firefox < 86.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  < 86
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
< 86	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (4)

https://bugzilla.mozilla.org/show_bug.cgi?id=1685145
x_refsource_MISCIssue TrackingPermissions RequiredVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-10896
Advisory
https://security.gentoo.org/glsa/202104-10
vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.mozilla.org/security/advisories/mfsa2021-07/
x_refsource_MISCRelease NotesVendor Advisory

Link	Providers	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1685145		x_refsource_MISCIssue TrackingPermissions RequiredVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-10896		Advisory
https://security.gentoo.org/glsa/202104-10		vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.mozilla.org/security/advisories/mfsa2021-07/		x_refsource_MISCRelease NotesVendor Advisory