description: When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.
problem types: Time-of-check time-of-use bug when verifying add-on signatures
affected:
{
vendor: Mozilla
product: Firefox
versions:
version: unspecified, lessThan: 98, status: affected, versionType: custom
}
{
vendor: Mozilla
product: Firefox ESR
versions:
version: unspecified, lessThan: 91.7, status: affected, versionType: custom
}
{
vendor: Mozilla
product: Thunderbird
versions:
version: unspecified, lessThan: 91.7, status: affected, versionType: custom
}
