CVE-2021-29955

MEDIUM

Firefox < 87.0 and Firefox ESR < 78.9 - Memory Address Leak via Floating Point Value Injection

Title source: llm

Description

A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.). This vulnerability affects Firefox ESR < 78.9 and Firefox < 87.

References (3)

Core 3

Core References

Release Notes, Vendor Advisory x_refsource_misc

https://www.mozilla.org/security/advisories/mfsa2021-10/

Release Notes, Vendor Advisory x_refsource_misc

https://www.mozilla.org/security/advisories/mfsa2021-11/

Permissions Required, Vendor Advisory x_refsource_misc

https://bugzilla.mozilla.org/show_bug.cgi?id=1692972

Scores

CVSS v3 5.3

EPSS 0.0088

EPSS Percentile 75.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE

CWE-74

Status published

Products (2)

mozilla/firefox < 87.0

mozilla/firefox_esr < 78.9

Published Jun 24, 2021

Tracked Since Feb 18, 2026