CVE-2021-29980 — Missing Initialization of Resource in Mozilla Firefox
CWE-909 — Missing Initialization of ResourceCWE-908 — Use of Uninitialized Resource13 documents8 sources
Severity
8.8HIGHNVD
OSV5.9
EPSS
0.4%
top 38.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedAug 17
Latest updateMay 24
Description
Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages8 packages
🔴Vulnerability Details
4GHSA▶
GHSA-5w5f-pvc9-xxph: Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash↗2022-05-24
CVEList▶
CVE-2021-29980: Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash↗2021-08-17
OSV▶
CVE-2021-29980: Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash↗2021-08-17
📋Vendor Advisories
8Red Hat
▶
Debian▶
CVE-2021-29980: firefox - Uninitialized memory in a canvas object could have caused an incorrect free() le...↗2021