Information disclosure in Mozilla Firefox - CVE-2021-29960
Published: June 1, 2021
Vulnerability identifier: #VU53710
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-29960
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to the way firefox uses cache for the last filename used for printing a file. Firefox usually suggests the web page title. The caching and suggestion techniques combined may have lead to the title of a website visited during private browsing mode being stored on disk.
Affected software
Mozilla Firefox
Arch Linux
Gentoo Linux
Ubuntu
firefox (Ubuntu package)
Arch Linux
Gentoo Linux
Ubuntu
firefox (Ubuntu package)
How to mitigate CVE-2021-29960
Install updates from vendor's website.
Mozilla Firefox - update to 89.0
firefox (Ubuntu package) - addressed in versions 89.0+build2-0ubuntu0.18.04.2, 89.0+build2-0ubuntu0.20.04.2, 89.0+build2-0ubuntu0.20.10.1, 89.0+build2-0ubuntu0.21.04.1
firefox (Ubuntu package) - addressed in versions 89.0+build2-0ubuntu0.18.04.2, 89.0+build2-0ubuntu0.20.04.2, 89.0+build2-0ubuntu0.20.10.1, 89.0+build2-0ubuntu0.21.04.1