Vulnerability Name:

CVE-2021-29970 (CCN-205295)

Assigned:2021-07-13
Published:2021-07-13
Updated:2022-12-09
Summary:A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.8 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:5.1 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
9.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-416
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2021-29970

Source: security@mozilla.org
Type: Exploit, Issue Tracking, Vendor Advisory
security@mozilla.org

Source: XF
Type: UNKNOWN
firefox-cve202129970-code-exec(205295)

Source: security@mozilla.org
Type: Third Party Advisory
security@mozilla.org

Source: security@mozilla.org
Type: Third Party Advisory
security@mozilla.org

Source: CCN
Type: IBM Security Bulletin 6493377 (Application Performance Management)
Multiple vulnerabilities of Mozilla Firefox (less than Firefox 78.14.0 ESR +CVE-2021-29967) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF14

Source: CCN
Type: Mozilla Foundation Security Advisory 2021-28
Security Vulnerabilities fixed in Firefox 90

Source: CCN
Type: Mozilla Foundation Security Advisory 2021-29
Security Vulnerabilities fixed in Firefox ESR 78.12

Source: security@mozilla.org
Type: Vendor Advisory
security@mozilla.org

Source: security@mozilla.org
Type: Vendor Advisory
security@mozilla.org

Source: security@mozilla.org
Type: Vendor Advisory
security@mozilla.org

Vulnerable Configuration:Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*
    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:*
    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*
    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*
    • Configuration RedHat 5:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*
    • Configuration RedHat 6:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:mozilla:firefox:89.0:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:application_performance_management:8.1.4:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:7868
    P
    		MozillaFirefox-102.11.0-150200.152.87.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:6107
    P
    		Security update for libnl3 (Moderate) (in QA)
    2022-08-08
    oval:org.opensuse.security:def:95333
    P
    		Security update for crash (Important) (in QA)
    2022-07-21
    oval:org.opensuse.security:def:6095
    P
    		Security update for xorg-x11-server (Important)
    2022-07-12
    oval:org.opensuse.security:def:3252
    P
    		libsmi-0.4.8-18.55 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3546
    P
    		libICE6-1.0.8-12.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:95176
    P
    		MozillaThunderbird-91.8.0-150200.8.65.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94785
    P
    		policycoreutils-3.1-150400.1.5 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94882
    P
    		MozillaFirefox-91.8.0-150200.152.26.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:111905
    P
    		MozillaThunderbird-91.1.1-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:111899
    P
    		MozillaFirefox-92.0-1.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:99707
    P
    		 (Important)
    2021-12-22
    oval:org.opensuse.security:def:100016
    P
    		 (Moderate)
    2021-11-16
    oval:org.opensuse.security:def:93108
    P
    		 (Important)
    2021-10-25
    oval:org.opensuse.security:def:105476
    P
    		MozillaFirefox-92.0-1.2 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:105478
    P
    		MozillaThunderbird-91.1.1-1.1 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:101498
    P
    		Security update for xen (Important)
    2021-09-02
    oval:org.opensuse.security:def:93261
    P
    		 (Important)
    2021-08-17
    oval:org.opensuse.security:def:110990
    P
    		Security update for MozillaThunderbird (Important)
    2021-08-04
    oval:org.opensuse.security:def:91972
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:9370
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:69510
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:99117
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:92757
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:10309
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:70449
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:8626
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:66874
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:92167
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:9559
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:69699
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:99309
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:5785
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:92955
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:8811
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:75942
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:92359
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:9758
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:69898
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:99508
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:108712
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:102046
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:9006
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:98922
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:92558
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:10124
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:org.opensuse.security:def:70264
    P
    		Security update for MozillaFirefox (Important)
    2021-07-27
    oval:com.redhat.rhsa:def:20212881
    P
    		RHSA-2021:2881: thunderbird security update (Important)
    2021-07-26
    oval:com.redhat.rhsa:def:20212883
    P
    		RHSA-2021:2883: thunderbird security update (Important)
    2021-07-26
    oval:org.opensuse.security:def:109651
    P
    		Security update for MozillaThunderbird (Important)
    2021-07-22
    oval:org.opensuse.security:def:102985
    P
    		Security update for MozillaThunderbird (Important)
    2021-07-22
    oval:org.opensuse.security:def:76264
    P
    		Security update for MozillaThunderbird (Important)
    2021-07-22
    oval:org.opensuse.security:def:10651
    P
    		Security update for MozillaThunderbird (Important)
    2021-07-22
    oval:org.opensuse.security:def:70791
    P
    		Security update for MozillaThunderbird (Important)
    2021-07-22
    oval:org.opensuse.security:def:102325
    P
    		Security update for MozillaThunderbird (Important)
    2021-07-22
    oval:org.opensuse.security:def:111640
    P
    		Security update for MozillaThunderbird (Important)
    2021-07-22
    oval:org.opensuse.security:def:10688
    P
    		Security update for MozillaThunderbird (Important)
    2021-07-22
    oval:org.opensuse.security:def:70828
    P
    		Security update for MozillaThunderbird (Important)
    2021-07-22
    oval:org.opensuse.security:def:67196
    P
    		Security update for MozillaThunderbird (Important)
    2021-07-22
    oval:org.opensuse.security:def:96313
    P
    		Security update for MozillaThunderbird (Important)
    2021-07-22
    oval:org.opensuse.security:def:119791
    P
    		Security update for MozillaThunderbird (Important)
    2021-07-22
    oval:org.opensuse.security:def:1773
    P
    		Security update for MozillaThunderbird (Important)
    2021-07-22
    oval:org.opensuse.security:def:110977
    P
    		Security update for MozillaFirefox (Important)
    2021-07-20
    oval:org.opensuse.security:def:74297
    P
    		Security update for MozillaFirefox (Important)
    2021-07-19
    oval:org.opensuse.security:def:4204
    P
    		Security update for MozillaFirefox (Important)
    2021-07-19
    oval:org.opensuse.security:def:74361
    P
    		Security update for MozillaFirefox (Important)
    2021-07-19
    oval:org.opensuse.security:def:101708
    P
    		Security update for MozillaFirefox (Important)
    2021-07-19
    oval:org.opensuse.security:def:111626
    P
    		Security update for MozillaFirefox (Important)
    2021-07-19
    oval:org.opensuse.security:def:108164
    P
    		Security update for MozillaFirefox (Important)
    2021-07-19
    oval:org.opensuse.security:def:67184
    P
    		Security update for MozillaFirefox (Important)
    2021-07-19
    oval:org.opensuse.security:def:117678
    P
    		Security update for MozillaFirefox (Important)
    2021-07-19
    oval:org.opensuse.security:def:65229
    P
    		Security update for MozillaFirefox (Important)
    2021-07-19
    oval:org.opensuse.security:def:4140
    P
    		Security update for MozillaFirefox (Important)
    2021-07-19
    oval:org.opensuse.security:def:76252
    P
    		Security update for MozillaFirefox (Important)
    2021-07-19
    oval:org.opensuse.security:def:65293
    P
    		Security update for MozillaFirefox (Important)
    2021-07-19
    oval:org.opensuse.security:def:29397
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:45589
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:59766
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:86604
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:31654
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:55925
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:82604
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:125570
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:23621
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:89163
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:33943
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:57963
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:84637
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:30102
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:51609
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:5076
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:38660
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:60308
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:87427
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:32140
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:56045
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:83309
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:126739
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:23937
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:43090
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:89421
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:34485
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:58786
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:85685
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:30222
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:51925
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:39950
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:88157
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:32963
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:57044
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:83429
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:127136
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:26089
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:44380
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:59508
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:86118
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:31221
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:55220
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:41159
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:88471
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:33685
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:57477
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:org.opensuse.security:def:84178
    P
    		Security update for MozillaFirefox (Important)
    2021-07-16
    oval:com.redhat.rhsa:def:20212741
    P
    		RHSA-2021:2741: firefox security update (Important)
    2021-07-15
    oval:com.redhat.rhsa:def:20212743
    P
    		RHSA-2021:2743: firefox security update (Important)
    2021-07-15
    BACK
    mozilla firefox 89.0
    ibm application performance management 8.1.4