CVE-2021-38495: High severity Mozilla Thunderbird vulnerability
Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.1 and Firefox ESR < 91.1.
Other sources
Mozilla developers Tyson Smith, Christian Holler, and Gabriele Svelto reported memory safety bugs present in Firefox 91 and Firefox ESR 91.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Mozilla developers Tyson Smith, Christian Holler, and Gabriele Svelto reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 91.1 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 91.1 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 91.2.0-r0 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 91.3.2-r0
Event History
Frequently Asked Questions
What is CVE-2021-38495?
CVE-2021-38495 is a memory safety bug present in Firefox 91 and Firefox ESR 91.0.
Is CVE-2021-38495 exploitable?
Yes, with enough effort, CVE-2021-38495 could have been exploited to run arbitrary code.
Which software versions are affected by CVE-2021-38495?
Mozilla Firefox ESR versions up to exclusive version 91.1 and Mozilla Thunderbird versions up to exclusive version 91.1 are affected by CVE-2021-38495.
What is the severity rating of CVE-2021-38495?
CVE-2021-38495 is rated with a severity of 7 (high).
How do I fix CVE-2021-38495?
To fix CVE-2021-38495, update your Mozilla Firefox ESR or Mozilla Thunderbird to version 91.1.