CVE-2021-29964 — Vulnetix

Try Vulnetix Request Demo

CVE-2021-29964 PUBLISHED

A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.

EPSS 0.32% · 55.2th percentile

Risk Scores

EPSS Score

0.32%

55.2th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:18.04:LTS	mozjs52	52.8.1-0ubuntu0.18.04.1, 52.3.1-7fakesync1, 52.3.1-0ubuntu3
Ubuntu:18.04:LTS	mozjs38	0, 38.8.0~repack1-0ubuntu1, 38.8.0~repack1-0ubuntu3
Ubuntu:22.04:LTS	mozjs78	78.13.0-1, 78.15.0-2, 78.15.0-4ubuntu1
Ubuntu:20.04:LTS	mozjs52	0, 52.9.1-1build1, 52.9.1-1ubuntu3
Ubuntu:20.04:LTS	mozjs68	68.6.0-1ubuntu1, 68.6.0-1, 68.5.0-2~fakesync

Timeline

Feb 24, 2021 CVE Published
Jun 25, 2021 EPSS Score
Jul 1, 2021 EPSS Score
Aug 24, 2021 EPSS Score
Oct 7, 2021 EPSS Score
Oct 22, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Feb 19, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Jun 18, 2022 EPSS Score
Aug 18, 2022 EPSS Score

References

https://ubuntu.com/security/CVE-2021-29964 third-party-advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2021-23/#CVE-2021-29964 third-party-advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2021-26/ third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2021-29964 third-party-advisory

Open in Interactive Console →