Out-of-bounds read in Firefox ESR and Mozilla Firefox - CVE-2021-29964

Vulnerability identifier: #VU53706

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-29964

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A locally-installed hostile program could send WM_COPYDATA messages that Firefox would processing incorrectly and will result in out-of-bounds read.

Note, the vulnerability affects Windows installations only.

Firefox ESR
Mozilla Firefox
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Workstation Extension
IBM Cloud Application Performance Management (APM)
Mozilla Thunderbird
MozillaFirefox-debugsource
MozillaFirefox-debuginfo
MozillaFirefox
MozillaFirefox-devel
MozillaFirefox-translations-common
MozillaFirefox-translations-other
MozillaThunderbird-debuginfo
MozillaThunderbird
MozillaThunderbird-debugsource
MozillaThunderbird-translations-common
MozillaThunderbird-translations-other

Install updates from vendor's website.

Firefox ESR - update to 78.11.0
Mozilla Firefox - update to 89.0
Mozilla Thunderbird - update to 78.11.0
MozillaFirefox-debugsource - addressed in versions 78.11.0-3.144.1, 78.11.0-8.43.1, 78.11.0-112.62.1
MozillaFirefox-debuginfo - addressed in versions 78.11.0-3.144.1, 78.11.0-8.43.1, 78.11.0-78.131.1, 78.11.0-112.62.1
MozillaFirefox - addressed in versions 78.11.0-3.144.1, 78.11.0-8.43.1, 78.11.0-78.131.1, 78.11.0-112.62.1
MozillaFirefox-devel - addressed in versions 78.11.0-3.144.1, 78.11.0-8.43.1, 78.11.0-112.62.1
MozillaFirefox-translations-common - addressed in versions 78.11.0-3.144.1, 78.11.0-8.43.1, 78.11.0-78.131.1, 78.11.0-112.62.1
MozillaFirefox-translations-other - addressed in versions 78.11.0-3.144.1, 78.11.0-8.43.1, 78.11.0-78.131.1
MozillaThunderbird-debuginfo - update to 78.11.0-8.30.1
MozillaThunderbird - update to 78.11.0-8.30.1
MozillaThunderbird-debugsource - update to 78.11.0-8.30.1
MozillaThunderbird-translations-common - update to 78.11.0-8.30.1
MozillaThunderbird-translations-other - update to 78.11.0-8.30.1

• https://www.mozilla.org/en-US/security/advisories/mfsa2021-24/
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

• Multiple vulnerabilities in Mozilla Firefox
• Multiple vulnerabilities in Mozilla Thunderbird
• SUSE update for MozillaFirefox
• SUSE update for MozillaFirefox
• SUSE update for MozillaFirefox
• SUSE update for MozillaFirefox
• SUSE update for MozillaThunderbird
• Multiple vulnerabilities in IBM Application Performance Management