#VU50887 Resource management error in Mozilla Firefox


Published: 2021-02-23

Vulnerability identifier: #VU50887

Vulnerability risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-23975

CWE-ID: CWE-399

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Mozilla Firefox
Client/Desktop applications / Web browsers

Vendor: Mozilla

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes. When this function was invoked, the browser called the sizeof function instead of using the API method that checks for invalid pointers.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 80.0 - 85.0.2


CPE

External links
http://www.mozilla.org/en-US/security/advisories/mfsa2021-07/


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?


Latest bulletins with this vulnerability