CVE-2021-29946

2021-06-2413:19:43

mozilla

www.cve.org

firefox

thunderbird

integer overflow

port blocking

alt-svc header

vulnerability

cve-2021-29946

AI Score

8.5

Confidence

High

EPSS

0.003

Percentile

68.8%

JSON

Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

CNA Affected

[
  {
    "product": "Firefox ESR",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "78.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Thunderbird",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "78.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Firefox",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "88",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]