CVE-2021-29989

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.13, Firefox ESR < 78.13, and Firefox < 91.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Aug 17, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-299908.8Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these bugs showed evidence of memory cor CVE-2021-299918.1Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. This allowed for a header splitting att CVE-2021-299938.1Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs. *This bug only CVE-2021-299946.1Cloudera Hue 4.6.0 allows XSS.CVE-2021-299958.8A Cross Site Request Forgery (CSRF) issue in Server Console in CloverDX through 5.9.0 allows remote attackers to execute any action as the l CVE-2021-299969.6Mark Text through 0.16.3 allows attackers arbitrary command execution. This could lead to Remote Code Execution (RCE) by opening .md files c CVE-2021-299975.3An issue was discovered in Wind River VxWorks 7 before 21.03. A specially crafted packet may lead to buffer over-read on IKE.CVE-2021-299989.8An issue was discovered in Wind River VxWorks before 6.5. There is a possible heap overflow in dhcp client.CVE-2021-299999.8An issue was discovered in Wind River VxWorks through 6.8. There is a possible stack overflow in dhcp server.CVE-2021-300009.8An issue was discovered in LATRIX 0.6.0. SQL injection in the txtaccesscode parameter of inandout.php leads to information disclosure and co CVE-2021-300026.2An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/v4l2-core/v4l2-ioctl.CVE-2021-300034.8An issue was discovered on Nokia G-120W-F 3FE46606AGAB91 devices. There is Stored XSS in the administrative interface via urlfilter.cgi?add