CVE-2021-38495
First published: Tue Sep 07 2021(Updated: )
Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.1 and Firefox ESR < 91.1.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox ESR | <91.1 | 91.1 |
| <91.1 | 91.1 | |
| <91.1 | 91.1 | |
| Mozilla Firefox ESR | <91.1 | |
| Mozilla Thunderbird | <91.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1723391%2C1723920%2C1724101%2C1724107
- https://www.mozilla.org/en-US/security/advisories/mfsa2021-40/
- https://www.mozilla.org/en-US/security/advisories/mfsa2021-41/
- https://security.gentoo.org/glsa/202202-03
- https://security.gentoo.org/glsa/202208-14
- https://www.mozilla.org/security/advisories/mfsa2021-40/
- https://www.mozilla.org/security/advisories/mfsa2021-41/
Frequently Asked Questions
What is CVE-2021-38495?
CVE-2021-38495 is a memory safety bug present in Firefox 91 and Firefox ESR 91.0.
Is CVE-2021-38495 exploitable?
Yes, with enough effort, CVE-2021-38495 could have been exploited to run arbitrary code.
Which software versions are affected by CVE-2021-38495?
Mozilla Firefox ESR versions up to exclusive version 91.1 and Mozilla Thunderbird versions up to exclusive version 91.1 are affected by CVE-2021-38495.
What is the severity rating of CVE-2021-38495?
CVE-2021-38495 is rated with a severity of 7 (high).
How do I fix CVE-2021-38495?
To fix CVE-2021-38495, update your Mozilla Firefox ESR or Mozilla Thunderbird to version 91.1.
- collector/mozilla-advisory
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- source/Mozilla
- agent/software-canonical-lookup
- agent/weakness
- agent/author
- agent/severity
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- agent/trending
- vendor/mozilla
- canonical/mozilla firefox esr
- canonical/mozilla thunderbird