CVE-2021-29964
published 2021-06-24CVE-2021-29964: A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only…
PriorityP427high7.1CVSS 3.1
AVLACLPRNUIRSUCHINAH
EPSS
0.79%
52.5th percentile
A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | — | — |
| debian | firefox-esr | — | — |
| debian | thunderbird | — | — |
| mozilla | firefox | < 89.0 | 89.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= unspecified < 89 | 89 |
| mozilla | firefox_esr | < 78.11 | 78.11 |
| mozilla | firefox_esr | >= unspecified < 78.11 | 78.11 |
| mozilla | thunderbird | < 78.11 | 78.11 |
| mozilla | thunderbird | >= unspecified < 78.11 | 78.11 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:P
osv7.1HIGH
vendor_debian7.1LOW
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6mgf-v5gc-vgc7: A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read
ghsa_unreviewed·2022-05-24
CVE-2021-29964 [HIGH] CWE-125 GHSA-6mgf-v5gc-vgc7: A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read
A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
OSV
CVE-2021-29964: A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read
osv·2021-06-24·CVSS 7.1
CVE-2021-29964 [HIGH] CVE-2021-29964: A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read
A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
Red Hat
Mozilla: Out of bounds-read when parsing a `WM_COPYDATA` message
vendor_redhat·2021-06-01·CVSS 7.1
CVE-2021-29964 [HIGH] CWE-125 Mozilla: Out of bounds-read when parsing a `WM_COPYDATA` message
Mozilla: Out of bounds-read when parsing a `WM_COPYDATA` message
A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
Package: firefox (Red Hat Enterprise Linux 6) - Out of support scope
Package: thunderbird (Red Hat Enterprise Linux 6) - Out of support scope
Package: firefox (Red Hat Enterprise Linux 7) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 7) - Not affected
Package: firefox (Red Hat Enterprise Linux 8) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 8) - Not affected
Debian
CVE-2021-29964: firefox - A locally-installed hostile program could send `WM_COPYDATA` messages that Firef...
vendor_debian·2021·CVSS 7.1
CVE-2021-29964 [HIGH] CVE-2021-29964: firefox - A locally-installed hostile program could send `WM_COPYDATA` messages that Firef...
A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.
Scope: local
sid: resolved
Mozilla
Mozilla Foundation Security Advisory 2021-24: CVE-2021-29964
vendor_mozilla·CVSS 7.1
CVE-2021-29964 [HIGH] Mozilla Foundation Security Advisory 2021-24: CVE-2021-29964
Mozilla Foundation Security Advisory 2021-24
CVE: CVE-2021-29964
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 78.11
Mozilla
Mozilla Foundation Security Advisory 2021-23: CVE-2021-29964
vendor_mozilla·CVSS 7.1
CVE-2021-29964 [HIGH] Mozilla Foundation Security Advisory 2021-23: CVE-2021-29964
Mozilla Foundation Security Advisory 2021-23
CVE: CVE-2021-29964
Product: Firefox
Impact: moderate
Fixed in: Firefox 89
Mozilla
Mozilla Foundation Security Advisory 2021-26: CVE-2021-29964
vendor_mozilla·CVSS 7.1
CVE-2021-29964 [HIGH] Mozilla Foundation Security Advisory 2021-26: CVE-2021-29964
Mozilla Foundation Security Advisory 2021-26
CVE: CVE-2021-29964
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 78.11
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1706501https://www.mozilla.org/security/advisories/mfsa2021-23/https://www.mozilla.org/security/advisories/mfsa2021-24/https://www.mozilla.org/security/advisories/mfsa2021-26/https://bugzilla.mozilla.org/show_bug.cgi?id=1706501https://www.mozilla.org/security/advisories/mfsa2021-23/https://www.mozilla.org/security/advisories/mfsa2021-24/https://www.mozilla.org/security/advisories/mfsa2021-26/
2021-06-24
Published