CVE-2021-43528: Medium severity thunderbird vulnerability
Published Dec 7, 2021
·Updated
Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with other vulnerabilities.
Affected Software
6 affected componentsFixes available
debian/thunderbird
1:91.12.0-1~deb10u11:115.3.1-1~deb10u11:102.13.1-1~deb11u11:115.3.1-1~deb11u11:102.15.1-1~deb12u11:115.3.1-1~deb12u11:115.3.1-1
Mozilla Thunderbird<91.4
91.4
Mozilla Thunderbird<91.4.0
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Event History
Dec 7, 2021
CVE Published
12:00 AM
Dec 8, 2021
CVE Published
via MITRE·09:21 PM
Data Sourced
via MITRE·09:21 PM
DescriptionWeakness
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeaknessAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
1
What is the severity of CVE-2021-43528?
CVE-2021-43528 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2021-43528?
To fix CVE-2021-43528, upgrade Thunderbird to version 91.4 or later.
3
What versions of Thunderbird are affected by CVE-2021-43528?
CVE-2021-43528 affects all versions of Thunderbird prior to 91.4.
4
Does CVE-2021-43528 allow for remote code execution?
No, CVE-2021-43528 does not allow for remote code execution, but it enables JavaScript in a limited context.
5
Is there any workaround for CVE-2021-43528?
There are no known effective workarounds for CVE-2021-43528, so upgrading is recommended.