PT-2021-6614 · Mozilla+5 · Thunderbird+6

Gary Kwong · Published 2021-08-10 · Updated 2024-12-12 · CVE-2021-29981

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 91 Thunderbird versions prior to 91

Description The issue is related to a problem in the JIT component of Firefox and Thunderbird, which could lead to a potentially exploitable crash due to register confusion failures in JITted code. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For Firefox versions prior to 91, update to version 91 or later to resolve the issue. For Thunderbird versions prior to 91, update to version 91 or later to resolve the issue.

Exploit

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

ALT-PU-2021-2488

ALT-PU-2021-2636

ALT-PU-2021-2718

ALT-PU-2021-2725

ALT-PU-2021-2849

ALT-PU-2021-2881

ALT-PU-2021-3368

ALT-PU-2021-3369

ALT-PU-2021-3370

ALT-PU-2022-1781

ALT-PU-2022-1782

ALT-PU-2022-1783

BDU:2022-01891

CVE-2021-29981

OESA-2023-1673

OESA-2023-1674

OPENSUSE-SU-2021:1367-1

OPENSUSE-SU-2021:1635-1

OPENSUSE-SU-2021:3331-1

OPENSUSE-SU-2021:3451-1

OPENSUSE-SU-2021:4150-1

OPENSUSE-SU-2021_1367-1

OPENSUSE-SU-2021_1635-1

OPENSUSE-SU-2021_3331-1

OPENSUSE-SU-2021_3451-1

OPENSUSE-SU-2021_4150-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2021:14821-1

SUSE-SU-2021:14826-1

SUSE-SU-2021:3191-1

SUSE-SU-2021:3331-1

SUSE-SU-2021:3451-1

SUSE-SU-2021:4150-1

SUSE-SU-2021_14821-1

SUSE-SU-2021_14826-1

SUSE-SU-2022:1577-1

SUSE-SU-2022:1582-1

SUSE-SU-2022_1577-1

SUSE-SU-2022_1582-1

USN-5037-1

USN-5037-2

USN-5248-1

Affected Products

Alt Linux

Astra Linux

Firefox

Linuxmint

Suse

Thunderbird

Ubuntu

References · 2278

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_jit_use_after_free.rb · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-26485 · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥 https://github.com/HassanAzze/CVE-2020-6514 · Exploit
• 🔥 https://github.com/hasan-khalil/CVE-2020-6514 · Exploit
• 🔥 https://github.com/rojhack/CVE-2020-6514 · Exploit
• 🔥 https://github.com/R0jhack/CVE-2020-6514 · Exploit
• 🔥❌ https://github.com/marcinguy/CVE-2020-15999 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2022-34471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-34479 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-26976 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4047 · Security Note
• https://ubuntu.com/security/CVE-2021-44538 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38473 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-28289 · Security Note