CVE-2021-29948 — Race Condition in Mozilla Thunderbird
CWE-362 — Race ConditionCWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition10 documents7 sources
Severity
2.5LOWNVD
OSV7.4
EPSS
0.1%
top 78.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 24
Latest updateMay 24
Description
Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replacing the file. This vulnerability affects Thunderbird < 78.10.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 1.0 | Impact: 1.4
Affected Packages6 packages
Patches
🔴Vulnerability Details
4GHSA▶
GHSA-7h9q-985f-8xvm: Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user↗2022-05-24
OSV▶
CVE-2021-29948: Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user↗2021-06-24
📋Vendor Advisories
5Debian▶
CVE-2021-29948: thunderbird - Signatures are written to disk before and read during verification, which might ...↗2021