Уязвимость зависания браузера через неоднократные обращения к интерфейсам истории и местоположения в Mozilla Firefox
Описание
Злоумышленник способен вызвать зависание браузера, повторно вызывая интерфейсы истории (history) и местоположения (location). Для устранения этой проблемы добавлено ограничение частоты на эти вызовы API.
Затронутые версии ПО
- Mozilla Firefox версии до 83
Тип уязвимости
Зависание
Ссылки
- Issue TrackingPermissions RequiredVendor Advisory
- Vendor Advisory
- Issue TrackingPermissions RequiredVendor Advisory
- Vendor Advisory
Уязвимые конфигурации
EPSS
4.3 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
Связанные уязвимости
Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by introducing rate-limiting to these API calls. This vulnerability affects Firefox < 83.
Repeated calls to the history and location interfaces could have been ...
Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by introducing rate-limiting to these API calls. This vulnerability affects Firefox < 83.
ALT-PU-2020-3384: package `firefox` update to version 83.0-alt1
ALT-PU-2021-2725: package `firefox-esr` update to version 91.0.1-alt1
EPSS
4.3 Medium
CVSS3
4.3 Medium
CVSS2