CVE-2021-29970

CVSS v3.1 8.8 (High)

CVSS v2.0 5.1 (Medium)

EPSS 0.81 % (82^th)

Affected Products 3

Advisories 31

A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. This bug could only be triggered when accessibility was enabled.. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90.

Weaknesses

CWE-416: Use After Free
CWE-787: Out-of-bounds Write

CVE Status: PUBLISHED
CNA: Mozilla Corporation
Published Date: 2021-08-05 20:15:08
(3 years ago)
Updated Date: 2022-12-09 19:04:59
(21 months ago)

Affected Products

Mozilla

Firefox
Firefox Esr
Thunderbird

Configuration #1

	CPE23	Up To
Mozilla Firefox prior 90.0 version	cpe:2.3:a:mozilla:firefox	< 90.0
Mozilla Firefox Esr prior 78.12 version	cpe:2.3:a:mozilla:firefox_esr	< 78.12
Mozilla Thunderbird prior 78.12 version	cpe:2.3:a:mozilla:thunderbird	< 78.12