Improper privilege management in Mozilla Thunderbird
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-269.
Summary
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also exposed attack surface in the maintenance service. *Note: This issue only affected Windows operating systems older than Win 10 build 1709. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.10.1, Firefox < 87, and Firefox ESR < 78.10.1.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mozilla | Thunderbird | before 78.10.1 | 78.10.1 | Patch available | CNA |
| Mozilla | Firefox | before 87 | 87 | Patch available | CNA |
| Mozilla | Firefox ESR | before 78.10.1 | 78.10.1 | Patch available | CNA |
- Thunderbird VendorMozilla Affected before 78.10.1 Fixed in 78.10.1 Patch available CNA
- Firefox VendorMozilla Affected before 87 Fixed in 87 Patch available CNA
- Firefox ESR VendorMozilla Affected before 78.10.1 Fixed in 78.10.1 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* | before 87.0 | Vulnerable | Mozilla |
| cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* | before 78.10.1 | Vulnerable | Mozilla |
| cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* | before 78.10.1 | Vulnerable | Mozilla |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* Versions before 87.0 Vulnerable ·Mozilla
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* Versions before 78.10.1 Vulnerable ·Mozilla
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* Versions before 78.10.1 Vulnerable ·Mozilla
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA Thunderbird (Mozilla) Fixed in 78.10.1
- Fix · CNA Firefox (Mozilla) Fixed in 87
- Fix · CNA Firefox ESR (Mozilla) Fixed in 78.10.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Mozilla Firefox 87
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-10572 Injection in Mozilla Firefox ESRPriority LOW 27
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 3 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2021-29951
- 2026-10-03 Alias added: GHSA-rc27-w7x3-jmp4
References
More Mozilla Firefox vulnerabilities
- TI-2024-08981 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.8
- TI-2022-09832 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.6
- TI-2019-08769 Improper input validation in Mozilla Firefox ESR KEVCVSS 3.1CRITICAL 10.0
- TI-2010-03577 Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before… KEVCVSS 3.1CRITICAL 9.8
- TI-2023-04799 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
- TI-2023-04477 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2021-29951 · CVE Program
- CVE-2021-29951 · NVD
- FIRST EPSS
- GHSA-rc27-w7x3-jmp4 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-29951 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences