oval_org.cisecurity_def_9026.xml

<definition xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" class="vulnerability" id="oval:org.cisecurity:def:9026" version="5">
  <metadata>
    <title>A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash.</title>
    <affected family="windows">
      <platform>Microsoft Windows 7</platform>
      <platform>Microsoft Windows 8</platform>
      <platform>Microsoft Windows 8.1</platform>
      <platform>Microsoft Windows 10</platform>
      <platform>Microsoft Windows Server 2008</platform>
      <platform>Microsoft Windows Server 2008 R2</platform>
      <platform>Microsoft Windows Server 2012</platform>
      <platform>Microsoft Windows Server 2012 R2</platform>
      <platform>Microsoft Windows Server 2016</platform>
      <platform>Microsoft Windows Server 2019</platform>
      <product>Mozilla Thunderbird</product>
      <product>Mozilla Firefox ESR</product>
      <product>Mozilla Firefox</product>
    </affected>
    <reference ref_id="CVE-2021-29985" ref_url="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29985" source="CVE" />
    <description>A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird &lt; 78.13, Thunderbird &lt; 91, Firefox ESR &lt; 78.13, and Firefox &lt; 91.</description>
    <oval_repository>
      <dates>
        <submitted date="2021-10-25T02:37:00+00:00">
          <contributor organization="GFI">Glenn Lugod</contributor>
        </submitted>
        <status_change date="2021-10-29T12:31:48.791Z">DRAFT</status_change>
        <status_change date="2021-11-12T12:59:56.686Z">INTERIM</status_change>
        <status_change date="2021-11-26T16:05:05.810Z">ACCEPTED</status_change>
      </dates>
      <status>ACCEPTED</status>
      <min_schema_version>5.10</min_schema_version>
    </oval_repository>
  </metadata>
  <criteria operator="OR">
    <criteria comment="Mozilla Thunderbird Mainline release is installed + version" operator="AND">
      <extend_definition comment="Mozilla Thunderbird Mainline release is installed" definition_ref="oval:org.mitre.oval:def:22093" />
      <criterion comment="Check if Mozilla Thunderbird Mainline version less than 78.13" test_ref="oval:org.cisecurity:tst:21237" />
    </criteria>
    <criteria comment="Mozilla Thunderbird Mainline release is installed + version" operator="AND">
      <extend_definition comment="Mozilla Thunderbird Mainline release is installed" definition_ref="oval:org.mitre.oval:def:22093" />
      <criterion comment="Check if Mozilla Thunderbird Mainline version less than 91.0" test_ref="oval:org.cisecurity:tst:21251" />
    </criteria>
    <criteria comment="Mozilla Firefox ESR release is installed + version" operator="AND">
      <extend_definition comment="Mozilla Firefox ESR is installed" definition_ref="oval:org.mitre.oval:def:22414" />
      <criterion comment="Check if Mozilla Firefox ESR version is less than 78.13" test_ref="oval:org.cisecurity:tst:21239" />
    </criteria>
    <criteria comment="Mozilla Firefox Mainline release is installed + version" operator="AND">
      <extend_definition comment="Mozilla Firefox Mainline release is installed" definition_ref="oval:org.mitre.oval:def:22259" />
      <criterion comment="Check if Mozilla Firefox Mainline version less than 91.0" test_ref="oval:org.cisecurity:tst:21254" />
    </criteria>
  </criteria>
</definition>