CVE-2021-23981
Mozilla: Texture upload into an unbound backing buffer resulted in an out-of-bound read
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.
Una carga de textura de un Objeto de Búfer de Píxeles podría haber confundido el código WebGL para omitir el enlace del búfer usado para descomprimirlo, resultando en la corrupción de la memoria y una filtración o bloqueo de información potencialmente explotable. Esta vulnerabilidad afecta a Firefox ESR versión 78.9, Firefox versiones anteriores a 87, and Thunderbird versiones anteriores a 78.9.
The Mozilla Foundation Security Advisory describes this issue as:
A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-01-13 CVE Reserved
- 2021-03-25 CVE Published
- 2023-12-15 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-125: Out-of-bounds Read
- CWE-787: Out-of-bounds Write
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1692832 | Issue Tracking |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.mozilla.org/security/advisories/mfsa2021-10 | 2022-05-03 | |
| https://www.mozilla.org/security/advisories/mfsa2021-11 | 2022-05-03 | |
| https://www.mozilla.org/security/advisories/mfsa2021-12 | 2022-05-03 | |
| https://access.redhat.com/security/cve/CVE-2021-23981 | 2021-03-25 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1942783 | 2021-03-25 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | < 87.0 Search vendor "Mozilla" for product "Firefox" and version " < 87.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | < 78.9 Search vendor "Mozilla" for product "Firefox Esr" and version " < 78.9" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Thunderbird Search vendor "Mozilla" for product "Thunderbird" | < 78.9 Search vendor "Mozilla" for product "Thunderbird" and version " < 78.9" | - |
Affected
| ||||||