Severity
High
Analysis Summary
CVE-2021-29990
Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVE-2021-29982
Mozilla Firefox could allow a remote attacker to obtain sensitive information, caused by incorrect JIT optimization and type confusion. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to leak single bit data.
CVE-2021-29985
Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in MediaCacheStream::NotifyDataReceived method. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service
CVE-2021-29987
Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by the displaying of permission panels after requesting multiple permissions, and closing the first permission panel. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to trick the user into accepting unwanted permissions on Linux.
CVE-2021-29980
Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by uninitialized memory in a canvas object. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVE-2021-29984
Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by incorrect instruction reordering during JIT optimization. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVE-2021-29983
Mozilla Firefox for Android could allow a remote attacker to bypass security restrictions, caused by getting stuck in fullscreen mode and the failure to exit after normal interactions. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions.
CVE-2021-29988
Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by incorrect style treatment that triggers an out-of-bounds read. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVE-2021-29981
Mozilla Firefox is vulnerable to a denial of service, caused by live range splitting in lowering/register allocation that leads to conflicting assignments in the JIT. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to cause the browser to crash.
CVE-2021-29986
Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a race condition when calling getaddrinfo. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVE-2021-29989
Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
Impact
- Code Execution
- Denial of Service
- Bypass Security
- Unauthorized Access
Affected Vendors
- Mozilla
Affected Products
- Mozilla Firefox 90
- Mozilla Firefox ESR 78.12
- Mozilla Firefox for Android 90
- Mozilla Thunderbird 78.12
Remediation
Refer to Mozilla Foundation Security Advisory 2021-33 for patch, upgrade or suggested workaround information.