PT-2021-7312 · Mozilla+1 · Firefox For Android+2

Wladimir Palant · Published 2021-06-03 · Updated 2024-12-12 · CVE-2021-29963

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 89 Firefox for Android versions prior to 89

Description The issue is related to insufficient authentication of data in the "Private Browsing" mode of Mozilla Firefox. It allows a remote attacker to cause a denial of service. The problem specifically affects the address bar search suggestions in private browsing mode, which were reusing session data from normal mode. This issue only affects Firefox for Android, with other operating systems being unaffected.

Recommendations For Firefox versions prior to 89, update to version 89 or later to resolve the issue. For Firefox for Android versions prior to 89, update to version 89 or later to resolve the issue. As a temporary workaround, consider disabling the address bar search suggestions in private browsing mode until a patch is available.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

ALT-PU-2021-1919

ALT-PU-2021-3368

ALT-PU-2022-1782

BDU:2022-05612

CVE-2021-29963

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

Affected Products

Alt Linux

Firefox

Firefox For Android

References · 1873

• https://osv.dev/vulnerability/CVE-2021-29963 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2021-23 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05612 · Security Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=1705068 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10600-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-29963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29963 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2021-23/#CVE-2021-29963 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-29963 · Security Note
• https://ubuntu.com/security/CVE-2021-29963 · Vendor Advisory
• https://suse.com/security/cve/CVE-2016-2830 · Note
• https://suse.com/security/cve/CVE-2022-45421 · Note
• https://suse.com/security/cve/CVE-2017-7783 · Note
• https://suse.com/security/cve/CVE-2021-32810 · Note