CVE-2021-23994

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-909

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-239958.8When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this c CVE-2021-239966.5By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing CVE-2021-239978.8Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We presume that with eno CVE-2021-239986.5Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerabilit CVE-2021-239998.8If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional pri CVE-2021-24007.5Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that ar CVE-2021-240003.1A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they w CVE-2021-240014.3A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructu CVE-2021-240028.8When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and CVE-2021-240057.5Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator versions before 6.3.0 may allow a CVE-2021-240068.8An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user CVE-2021-240079.8Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated