Paper/Archive/CVE-2021-4129

CVE-2021-4129

Mozilla Firefox — Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakan…

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 64.6.646 × 2012.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in Firefox 94. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 95, Firefox ESR < 91.4.0, and Thunderbird < 91.4.0.

Affected

ProductAffectedFixed inSource

Firefoxunspecified – < 9595CNA

Firefox ESRunspecified – < 91.4.091.4.0CNA

Thunderbirdunspecified – < 91.4.091.4.0CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refmozilla.org/security/advisories/mfsa2021-53 refmozilla.org/security/advisories/mfsa2021-54 refmozilla.org/security/advisories/mfsa2021-52 refbugzilla.mozilla.org/buglist.cgi?bug_id=1393362%2C1736046%2C1736751%2C1737009%2C1739372%2C1739421