Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-29955

A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.). This vulnerability affects Firefox ESR < 78.9 and Firefox < 87.

Published

2021-06-24T14:15:10.053

Last Modified

2024-11-21T06:02:03.303

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: HIGH
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

4.9

Impact Score

2.9

Weaknesses

Type: Primary
CWE-74

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mozilla	firefox	< 87.0	Yes
Application	mozilla	firefox_esr	< 78.9	Yes

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1692972 Permissions Required, Vendor Advisory ([email protected])
https://www.mozilla.org/security/advisories/mfsa2021-10/ Release Notes, Vendor Advisory ([email protected])
https://www.mozilla.org/security/advisories/mfsa2021-11/ Release Notes, Vendor Advisory ([email protected])
https://bugzilla.mozilla.org/show_bug.cgi?id=1692972 Permissions Required, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.mozilla.org/security/advisories/mfsa2021-10/ Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.mozilla.org/security/advisories/mfsa2021-11/ Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)