| Name | CVE-2021-43538 |
| Description | By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-2863-1, DLA-2874-1, DSA-5026-1, DSA-5034-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| firefox (PTS) | sid | 133.0.3-1 | fixed |
| firefox-esr (PTS) | jessie, jessie (lts) | 68.9.0esr-1~deb8u2 | vulnerable |
| stretch (security), stretch (lts), stretch | 91.11.0esr-1~deb9u1 | fixed | |
| buster (security), buster, buster (lts) | 115.12.0esr-1~deb10u1 | fixed | |
| bullseye | 115.14.0esr-1~deb11u1 | fixed | |
| bullseye (security) | 128.5.0esr-1~deb11u1 | fixed | |
| bookworm | 128.3.1esr-1~deb12u1 | fixed | |
| bookworm (security) | 128.5.0esr-1~deb12u1 | fixed | |
| trixie | 128.5.0esr-1 | fixed | |
| sid | 128.5.1esr-1 | fixed | |
| thunderbird (PTS) | jessie, jessie (lts) | 1:68.9.0-1~deb8u2 | vulnerable |
| stretch (security), stretch (lts), stretch | 1:91.10.0-1~deb9u1 | fixed | |
| buster (security), buster, buster (lts) | 1:115.12.0-1~deb10u1 | fixed | |
| bullseye | 1:115.12.0-1~deb11u1 | fixed | |
| bullseye (security) | 1:128.5.0esr-1~deb11u1 | fixed | |
| bookworm | 1:115.16.0esr-1~deb12u1 | fixed | |
| bookworm (security) | 1:128.5.0esr-1~deb12u1 | fixed | |
| sid, trixie | 1:128.5.2esr-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| firefox | source | (unstable) | 95.0-1 | |||
| firefox-esr | source | jessie | (unfixed) | end-of-life | ||
| firefox-esr | source | stretch | 91.4.1esr-1~deb9u1 | DLA-2863-1 | ||
| firefox-esr | source | bullseye | 91.4.1esr-1~deb11u1 | DSA-5026-1 | ||
| firefox-esr | source | (unstable) | 91.4.0esr-1 | |||
| thunderbird | source | jessie | (unfixed) | end-of-life | ||
| thunderbird | source | stretch | 1:91.4.1-1~deb9u1 | DLA-2874-1 | ||
| thunderbird | source | buster | 1:91.4.1-1~deb10u1 | DSA-5034-1 | ||
| thunderbird | source | bullseye | 1:91.4.1-1~deb11u1 | DSA-5034-1 | ||
| thunderbird | source | (unstable) | 1:91.4.0-1 |
https://www.mozilla.org/en-US/security/advisories/mfsa2021-52/#CVE-2021-43538
https://www.mozilla.org/en-US/security/advisories/mfsa2021-53/#CVE-2021-43538
https://www.mozilla.org/en-US/security/advisories/mfsa2021-54/#CVE-2021-43538