CVE-2021-29989

Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.13, Firefox ESR < 78.13, and Firefox < 91.

• CWE-787

• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662676%2C1666184%2C1719178%2C1719998%2C1720568Vendor Advisory
• https://security.gentoo.org/glsa/202202-03Third Party Advisory
• https://security.gentoo.org/glsa/202208-14Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-33/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-34/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-35/Vendor Advisory
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662676%2C1666184%2C1719178%2C1719998%2C1720568Vendor Advisory
• https://security.gentoo.org/glsa/202202-03Third Party Advisory
• https://security.gentoo.org/glsa/202208-14Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-33/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-34/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-35/Vendor Advisory

Published

Aug 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29983Firefox for Android could get stuck in fullscreen mode and n…6.5
• CVE-2021-29984Instruction reordering resulted in a sequence of instruction…8.8
• CVE-2021-29985A use-after-free vulnerability in media channels could have …8.8
• CVE-2021-29986A suspected race condition when calling getaddrinfo led to m…8.1
• CVE-2021-29987After requesting multiple permissions, and closing the first…6.5
• CVE-2021-29988Firefox incorrectly treated an inline list-item element as a…8.8
• CVE-2021-29990Mozilla developers and community members reported memory saf…8.8
• CVE-2021-29991Firefox incorrectly accepted a newline in a HTTP/3 header, i…8.1
• CVE-2021-29993Firefox for Android allowed navigations through the `intent:…8.1
• CVE-2021-29994Cloudera Hue 4.6.0 allows XSS.6.1
• CVE-2021-29995A Cross Site Request Forgery (CSRF) issue in Server Console …8.8
• CVE-2021-29996Mark Text through 0.16.3 allows attackers arbitrary command …9.6