CVE-2021-29964
First published: Tue Jun 01 2021(Updated: )
A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox ESR | <78.11 | 78.11 |
| Mozilla Firefox | <89 | 89 |
| Mozilla Thunderbird | <78.11 | 78.11 |
| Mozilla Firefox | <89.0 | |
| Mozilla Firefox ESR | <78.11 | |
| Mozilla Thunderbird | <78.11 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1706501
- https://www.mozilla.org/en-US/security/advisories/mfsa2021-24/
- https://www.mozilla.org/en-US/security/advisories/mfsa2021-23/
- https://www.mozilla.org/en-US/security/advisories/mfsa2021-26/
- https://www.mozilla.org/security/advisories/mfsa2021-23/
- https://www.mozilla.org/security/advisories/mfsa2021-24/
- https://www.mozilla.org/security/advisories/mfsa2021-26/
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the severity of CVE-2021-29964?
The severity of CVE-2021-29964 is medium (4 out of 10).
How does CVE-2021-29964 affect Thunderbird?
CVE-2021-29964 affects Thunderbird on Windows and can lead to an out-of-bounds read.
Is Thunderbird the only affected software by CVE-2021-29964?
No, Thunderbird is not the only affected software by CVE-2021-29964. It also affects Firefox ESR and Firefox versions up to 89.
How can I fix CVE-2021-29964?
To fix CVE-2021-29964, update Thunderbird to version 78.11 or later for Thunderbird, and update Firefox to version 78.11 or later for Firefox ESR, or version 89 or later for Firefox.
Where can I find more information about CVE-2021-29964?
You can find more information about CVE-2021-29964 in the Mozilla advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2021-23/
- collector/mozilla-advisory
- agent/type
- agent/first-publish-date
- source/Mozilla
- agent/software-canonical-lookup
- agent/references
- agent/weakness
- agent/author
- agent/severity
- agent/softwarecombine
- agent/software-canonical-lookup-request
- agent/description
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- agent/trending
- vendor/mozilla
- canonical/mozilla firefox esr
- canonical/mozilla thunderbird
- canonical/mozilla firefox
- vendor/microsoft
- canonical/microsoft windows