CVE-2021-23960

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1675755
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-04/
• https://www.mozilla.org/security/advisories/mfsa2021-03/
• https://www.mozilla.org/security/advisories/mfsa2021-04/
• https://www.mozilla.org/security/advisories/mfsa2021-05/
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-04/#CVE-2021-23960
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23960
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23960
• https://security-tracker.debian.org/tracker/CVE-2021-23960

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2021-05
• MFSA2021-03
• MFSA2021-04

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2021-23953
• CVE-2021-23954
• CVE-2020-15685
• CVE-2020-26976
• CVE-2021-23960
• CVE-2021-23964
• CVE-2021-23955
• CVE-2021-23956
• CVE-2021-23957
• CVE-2021-23958
• CVE-2021-23959
• CVE-2021-23961
• CVE-2021-23962
• CVE-2021-23963
• CVE-2021-23965

Frequently Asked Questions

• What is the severity of CVE-2021-23960?

  CVE-2021-23960 is classified as a high-severity vulnerability due to the potential for user-after-poison exploitation leading to a crash.

• How do I fix CVE-2021-23960?

  To resolve CVE-2021-23960, upgrade affected applications to versions newer than 78.7 for Thunderbird or 85 for Firefox.

• Which software is affected by CVE-2021-23960?

  CVE-2021-23960 affects Mozilla Thunderbird versions up to 78.7, Firefox versions up to 85, and Firefox ESR versions up to 78.7.

• What is the impact of CVE-2021-23960 on users?

  Users of vulnerable software may experience crashes and could be exposed to potential exploit scenarios due to unhandled JavaScript variables.

• Is CVE-2021-23960 being actively exploited?

  There have been reports suggesting that CVE-2021-23960 may be exploited in the wild, which emphasizes the importance of updating affected applications promptly.