The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.
|Base Score:||10||Base Metrics:||AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H|
|Access Vector:||Network||Attack Complexity:||Low|
|Privileges Required:||None||User Interaction:||None|
|Integrity Impact:||High||Availability Impact:||High|
|Oracle Linux version 7 (firefox)||ELSA-2021-4116||2021-11-04|
|Oracle Linux version 7 (thunderbird)||ELSA-2021-4134||2021-11-05|
|Oracle Linux version 8 (firefox)||ELSA-2021-4123||2021-11-04|
|Oracle Linux version 8 (thunderbird)||ELSA-2021-4130||2021-11-05|
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team