CVE-2021-23979

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Mozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Mozilla	Firefox	< 86

References

https://bugzilla.mozilla.org/buglist.cgi?bug_id=1663222%2C1666607%2C1672120%2C1678463%2C1678927%2C1679560%2C1681297%2C1681684%2C1683490%2C1684377%2C1684902Exploit, Issue Tracking, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-07/Release Notes, Vendor Advisory
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1663222%2C1666607%2C1672120%2C1678463%2C1678927%2C1679560%2C1681297%2C1681684%2C1683490%2C1684377%2C1684902Exploit, Issue Tracking, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-07/Release Notes, Vendor Advisory

Timeline

Published: Feb 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-23988.1Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Region Mapping). Supported versions t CVE-2021-239806.1A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscrip CVE-2021-239818.1A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memo CVE-2021-239826.5Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as s CVE-2021-239836.5By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memo CVE-2021-239846.5A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be f CVE-2021-239856.5If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the Devtools remote debug CVE-2021-239866.5A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The CVE-2021-239878.8Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed e CVE-2021-239888.8Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corruption and we presume CVE-2021-23994.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.25 and prio CVE-2021-239916.8If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's update