CVE-2021-23995 Use after free in Firefox
A use-after-free vulnerability in Firefox's Responsive Design Mode could allow arbitrary code execution if exploited.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-23995?
CVE-2021-23995 is a high-severity use after free vulnerability in Mozilla Firefox, published on 24 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
Weakness: CWE-672
Which versions are affected by CVE-2021-23995?
It affects 3 products.
Products include Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird.
How do I fix CVE-2021-23995?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2021-23995 being exploited?
There is no known exploitation of CVE-2021-23995 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as DEBIAN-CVE-2021-23995, GHSA-h42x-74c2-hxvc, UBUNTU-CVE-2021-23995.