<p>Upgrade <code>Debian:unstable</code> <code>firefox</code> to version 87.0-1 or higher.</p>

Arbitrary Code Injection Affecting firefox package, versions <87.0-1

Snyk CVSS

Attack Complexity High

User Interaction Required

Confidentiality High

Threat Intelligence

EPSS 0.23% (61^st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-DEBIANUNSTABLE-FIREFOX-1314371
published 25 Jun 2021
disclosed 24 Jun 2021

Report a new vulnerability Found a mistake?

Introduced: 24 Jun 2021

CVE-2021-29955 Open this link in a new tab CWE-74 Open this link in a new tab

How to fix?

Upgrade Debian:unstable firefox to version 87.0-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream firefox package and not the firefox package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.). This vulnerability affects Firefox ESR < 78.9 and Firefox < 87.