CVE-2021-43535: Use After Free
A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash.
Other sources
A use-after-free could have occurred when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 118.0.2-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.12.0esr-1~deb10u1Fixed in 115.3.1esr-1~deb10u1Fixed in 102.15.0esr-1~deb11u1Fixed in 115.3.1esr-1~deb11u1Fixed in 102.15.1esr-1~deb12u1Fixed in 115.3.0esr-1~deb12u1Fixed in 115.3.0esr-1Fixed in 115.4.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:91.12.0-1~deb10u1Fixed in 1:115.3.1-1~deb10u1Fixed in 1:102.13.1-1~deb11u1Fixed in 1:115.3.1-1~deb11u1Fixed in 1:102.15.1-1~deb12u1Fixed in 1:115.3.1-1~deb12u1Fixed in 1:115.3.1-1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 93 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 91.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 93 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 91.3.2-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2021-43535?
CVE-2021-43535 is a vulnerability that could lead to memory corruption and a potentially exploitable crash in Firefox, Thunderbird, and Firefox ESR.
Which software is affected by CVE-2021-43535?
Firefox versions earlier than 93, Thunderbird versions earlier than 91.3, and Firefox ESR versions earlier than 91.3 are affected by CVE-2021-43535.
What is the severity of CVE-2021-43535?
The severity of CVE-2021-43535 is high with a severity value of 7.
How can I fix CVE-2021-43535 in Firefox?
To fix CVE-2021-43535 in Firefox, update your browser to version 93 or later.
How can I fix CVE-2021-43535 in Thunderbird or Firefox ESR?
To fix CVE-2021-43535 in Thunderbird or Firefox ESR, update your software to version 91.3 or later.