CVE-2021-29947

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Mozilla developers and community members reported memory safety bugs present in Firefox 87. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 88.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-299482.5Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local proces CVE-2021-299497.8When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filenam CVE-2021-299507.5Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. If the task runs into a failure,CVE-2021-299516.5The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access CVE-2021-299527.5When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort ma CVE-2021-299536.1A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another dom CVE-2021-299549.8Proxy functionality built into Hubs Cloud’s Reticulum software allowed access to internal URLs, including the metadata service. This vulnera CVE-2021-299555.3A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and CVE-2021-299564.3OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local di CVE-2021-299574.3If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thund CVE-2021-299584.3When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookies CVE-2021-299594.3When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from