CVE-2021-29990

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 91.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 91

References

https://bugzilla.mozilla.org/buglist.cgi?bug_id=1544190%2C1716481%2C1717778%2C1719319%2C1722073Broken Link, Issue Tracking, Vendor Advisory
https://security.gentoo.org/glsa/202202-03Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2021-33/Vendor Advisory
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1544190%2C1716481%2C1717778%2C1719319%2C1722073Broken Link, Issue Tracking, Vendor Advisory
https://security.gentoo.org/glsa/202202-03Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2021-33/Vendor Advisory

Timeline

Published: Aug 17, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-299918.1Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. This allowed for a header splitting att CVE-2021-299938.1Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs. *This bug only CVE-2021-299946.1Cloudera Hue 4.6.0 allows XSS.CVE-2021-299958.8A Cross Site Request Forgery (CSRF) issue in Server Console in CloverDX through 5.9.0 allows remote attackers to execute any action as the l CVE-2021-299969.6Mark Text through 0.16.3 allows attackers arbitrary command execution. This could lead to Remote Code Execution (RCE) by opening .md files c CVE-2021-299975.3An issue was discovered in Wind River VxWorks 7 before 21.03. A specially crafted packet may lead to buffer over-read on IKE.CVE-2021-299989.8An issue was discovered in Wind River VxWorks before 6.5. There is a possible heap overflow in dhcp client.CVE-2021-299999.8An issue was discovered in Wind River VxWorks through 6.8. There is a possible stack overflow in dhcp server.CVE-2021-300009.8An issue was discovered in LATRIX 0.6.0. SQL injection in the txtaccesscode parameter of inandout.php leads to information disclosure and co CVE-2021-300026.2An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/v4l2-core/v4l2-ioctl.CVE-2021-300034.8An issue was discovered on Nokia G-120W-F 3FE46606AGAB91 devices. There is Stored XSS in the administrative interface via urlfilter.cgi?add CVE-2021-300045.3In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x5