A number of vulnerabilities were fixed in Firefox that was fixed in the latest version. MSFA2021-08 describes it only as "memory issues that may be exploitable", and doesn't give any information:

Mozilla developers Alexis Beingessner, Tyson Smith, Nika Layzell, and Mats Palmgren reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

This is the boilerplate information they give for nearly every MSFA which bundles nearly all memory safety issues into one description. As usual, the bug reference is linked but it cannot be viewed.

When looking up the CVE, the only reference I can see is to this website which says the following:

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

This implies that it's one bug. Where did they get this information from, and are all the "safety bugs" in MFSA-2021-08 really specific to the HTML parser? So really, what is CVE-2021-23978?

  • 1
    If you're motivated and you know how to read code, i suggest you to have a look to the patchset between both versions .... Source code never lie nor hide :-)
    – binarym
    Aug 17 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.