CVE-2021-29964: High severity Mozilla Thunderbird vulnerability
A locally-installed hostile program could send WMCOPYDATA messages that Firefox would process incorrectly, leading to an out-of-bounds read. This bug only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
Other sources
A locally-installed hostile program could send WMCOPYDATA messages that Firefox would process incorrectly, leading to an out-of-bounds read. This bug only affects Firefox on Windows. Other operating systems are unaffected.
— Mozilla
A locally-installed hostile program could send WMCOPYDATA messages that Firefox would processing incorrectly, leading to an out-of-bounds read. This bug only affects Firefox on Windows. Other operating systems are unaffected.
A locally-installed hostile program could send WMCOPYDATA messages that Thunderbird would processing incorrectly, leading to an out-of-bounds read. This bug only affects Thunderbird on Windows. Other operating systems are unaffected.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 78.11 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 89 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 78.11 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 91.3.2-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2021-29964?
The severity of CVE-2021-29964 is medium (4 out of 10).
How does CVE-2021-29964 affect Thunderbird?
CVE-2021-29964 affects Thunderbird on Windows and can lead to an out-of-bounds read.
Is Thunderbird the only affected software by CVE-2021-29964?
No, Thunderbird is not the only affected software by CVE-2021-29964. It also affects Firefox ESR and Firefox versions up to 89.
How can I fix CVE-2021-29964?
To fix CVE-2021-29964, update Thunderbird to version 78.11 or later for Thunderbird, and update Firefox to version 78.11 or later for Firefox ESR, or version 89 or later for Firefox.
Where can I find more information about CVE-2021-29964?
You can find more information about CVE-2021-29964 in the Mozilla advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2021-23/