CVE-2021-29952
Fixed in a distro release EPSS <1%
When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3.
Products: Mozilla Firefox, Mozilla Firefox for Android
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | firefox | 88.0.1-1 |
| Ubuntu 18.04 LTS | firefox | 88.0.1+build1-0ubuntu0.18.04.2 |
| Ubuntu 18.04 LTS | mozjs38 | no fix |
| Ubuntu 18.04 LTS | mozjs52 | no fix |
| Ubuntu 20.04 LTS | firefox | 88.0.1+build1-0ubuntu0.20.04.2 |
| Ubuntu 20.04 LTS | mozjs52 | no fix |
| Ubuntu 20.04 LTS | mozjs68 | no fix |
| Ubuntu 22.04 LTS | mozjs78 | no fix |
| openSUSE Tumbleweed | MozillaFirefox | 92.0-1.2 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 |