PT-2021-2750 · Mozilla+7 · Thunderbird+7

Kai Engert + 1 · Published 2021-04-19 · Updated 2024-06-15 · CVE-2021-29948

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 78.10

Description: The issue is caused by a synchronization error when using a shared resource, which might be subject to a race condition when a malicious local process or user is replacing a file. This could allow a remote attacker to bypass existing security restrictions. Signatures are written to disk before and read during verification, which can be exploited.

Recommendations: For versions prior to 78.10, update to version 78.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the file system to minimize the risk of exploitation. Avoid using shared resources until the issue is resolved.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALT-PU-2021-1804

ALT-PU-2021-1886

ALT-PU-2021-1892

BDU:2021-02286

CESA-2021_1353

CVE-2021-29948

DLA-2632-1

DSA-4897-1

MGASA-2021-0198

OPENSUSE-SU-2021:0644-1

OPENSUSE-SU-2021_0644-1

OPENSUSE-SU-2024:10601-1

RHSA-2021:1350

RHSA-2021:1351

RHSA-2021:1352

RHSA-2021:1353

RHSA-2021_1350

RHSA-2021_1353

SUSE-SU-2021:1432-1

USN-4995-1

USN-4995-2

Affected Products

Alt Linux

Astra Linux

Centos

Linuxmint

Red Hat

Suse

Thunderbird

Ubuntu

References · 452

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1692899 · Exploit
• https://ubuntu.com/security/CVE-2021-29946 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-29948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29948 · Security Note
• https://ubuntu.com/security/CVE-2021-29967 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23984 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23995 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0198.html · Security Note
• https://ubuntu.com/security/CVE-2021-23991 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2021-14 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-29948 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4995-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23998 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23987 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23981 · Vendor Advisory