CVE-2021-29951
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain...
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also exposed attack surface in the maintenance service. Note: This issue only affected Windows operating systems older than Win 10 build 1709. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 78.10.1, Firefox < 87, and Firefox ESR < 78.10.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also exposed attack surface in the maintenance service. Note: This issue only affected Windows operating systems older than Win 10 build 1709. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 78.10.1, Firefox < 87, and Firefox ESR < 78.10.1.
- Record
CVE-2021-29951- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-269
- Updated
- 2026-11-02
CVE List No score
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also exposed attack surface in the maintenance service. Note: This issue only affected Windows operating systems older than Win 10 build 1709. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 78.10.1, Firefox < 87, and Firefox ESR < 78.10.1.
- Record
CVE-2021-29951- Updated
- 2026-11-02
EUVDEUVD-2021-16410 No score
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also exposed attack surface in the maintenance service. Note: This issue only affected Windows operating systems older than Win 10 build 1709. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 78.10.1, Firefox < 87, and Firefox ESR < 78.10.1.
- Record
EUVD-2021-16410- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rc27-w7x3-jmp4
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain...
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also exposed attack surface in the maintenance service. Note: This issue only affected Windows operating systems older than Win 10 build 1709. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 78.10.1, Firefox < 87, and Firefox ESR < 78.10.1.
- Record
GHSA-rc27-w7x3-jmp4- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-29951
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also exposed attack surface in the maintenance service. Note: This issue only affected Windows operating systems older than Win 10 build 1709. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 78.10.1, Firefox < 87, and Firefox ESR < 78.10.1.
- Record
ALPINE-CVE-2021-29951- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
OSVopenSUSE-SU-2021:0858-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 78.11.0 ESR (bsc#1186696)
- CVE-2021-29964: Out of bounds-read when parsing a
WM_COPYDATAmessage - CVE-2021-29967: Memory safety bugs fixed in Firefox
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2021:0858-1- Updated
- 2026-11-02
Show 7 moreShow less
OSVopenSUSE-SU-2021:1854-1 No score
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 78.10.2
- CVE-2021-29957: Fixed partial protection of inline OpenPGP message not indicated (bsc#1186198).
- CVE-2021-29956: Fixed Thunderbird stored OpenPGP secret keys without master password protection (bsc#1186199).
- CVE-2021-29951: Fixed Thunderbird Maintenance Service could have been started or stopped by domain users (bsc#1185633).
- CVE-2021-29950: Fixed logic issue potentially leaves key material unlocked (bsc#1185086).
- Record
openSUSE-SU-2021:1854-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1884-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 78.11.0 ESR (bsc#1186696)
- CVE-2021-29964: Out of bounds-read when parsing a
WM_COPYDATAmessage - CVE-2021-29967: Memory safety bugs fixed in Firefox
- Record
openSUSE-SU-2021:1884-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:14743-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 78.11.0 ESR (bsc#1186696)
- CVE-2021-29964: Out of bounds-read when parsing a
WM_COPYDATAmessage - CVE-2021-29967: Memory safety bugs fixed in Firefox
- Record
SUSE-SU-2021:14743-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1854-1 No score
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
- Mozilla Thunderbird 78.10.2
- CVE-2021-29957: Fixed partial protection of inline OpenPGP message not indicated (bsc#1186198).
- CVE-2021-29956: Fixed Thunderbird stored OpenPGP secret keys without master password protection (bsc#1186199).
- CVE-2021-29951: Fixed Thunderbird Maintenance Service could have been started or stopped by domain users (bsc#1185633).
- CVE-2021-29950: Fixed logic issue potentially leaves key material unlocked (bsc#1185086).
- Record
SUSE-SU-2021:1854-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1884-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 78.11.0 ESR (bsc#1186696)
- CVE-2021-29964: Out of bounds-read when parsing a
WM_COPYDATAmessage - CVE-2021-29967: Memory safety bugs fixed in Firefox
- Record
SUSE-SU-2021:1884-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1886-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 78.11.0 ESR (bsc#1186696)
- CVE-2021-29964: Out of bounds-read when parsing a
WM_COPYDATAmessage - CVE-2021-29967: Memory safety bugs fixed in Firefox
- Record
SUSE-SU-2021:1886-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1919-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 78.11.0 ESR (bsc#1186696)
- CVE-2021-29964: Out of bounds-read when parsing a
WM_COPYDATAmessage - CVE-2021-29967: Memory safety bugs fixed in Firefox
- Record
SUSE-SU-2021:1919-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thunderbirdAlpine:v3.16 |
before 91.3.2-r0 | 91.3.2-r0 |
thunderbirdAlpine:v3.17 |
before 91.3.2-r0 | 91.3.2-r0 |
thunderbirdAlpine:v3.18 |
before 91.3.2-r0 | 91.3.2-r0 |
thunderbirdAlpine:v3.19 |
before 91.3.2-r0 | 91.3.2-r0 |
thunderbirdAlpine:v3.20 |
before 91.3.2-r0 | 91.3.2-r0 |
thunderbirdAlpine:v3.21 |
before 91.3.2-r0 | 91.3.2-r0 |
thunderbirdAlpine:v3.22 |
before 91.3.2-r0 | 91.3.2-r0 |
thunderbirdAlpine:v3.23 |
before 91.3.2-r0 | 91.3.2-r0 |
MozillaFirefoxSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 3 CVEs |
before 78.11.0-78.131.1 | 78.11.0-78.131.1 |
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP2 From an advisory covering 4 CVEs |
before 78.10.2-8.27.1 | 78.10.2-8.27.1 |
Show 33 moreShow less
| Package | Affected | Fixed |
|---|---|---|
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP3 From an advisory covering 4 CVEs |
before 78.10.2-8.27.1 | 78.10.2-8.27.1 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP2 From an advisory covering 3 CVEs |
before 78.11.0-8.43.1 | 78.11.0-8.43.1 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP3 From an advisory covering 3 CVEs |
before 78.11.0-8.43.1 | 78.11.0-8.43.1 |
MozillaFirefoxSUSE:HPE Helion OpenStack 8 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:OpenStack Cloud 8 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:OpenStack Cloud 9 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 3 CVEs |
before 78.11.0-112.62.1 | 78.11.0-112.62.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Manager Proxy 4.0 From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Manager Retail Branch Server 4.0 From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Manager Server 4.0 From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxSUSE:Enterprise Storage 6 From an advisory covering 3 CVEs |
before 78.11.0-3.144.1 | 78.11.0-3.144.1 |
MozillaFirefoxopenSUSE:Leap 15.2 From an advisory covering 3 CVEs |
before 78.11.0-lp152.2.58.1 | 78.11.0-lp152.2.58.1 |
MozillaThunderbirdopenSUSE:Leap 15.3 From an advisory covering 4 CVEs |
before 78.10.2-8.27.1 | 78.10.2-8.27.1 |
MozillaFirefoxopenSUSE:Leap 15.3 From an advisory covering 3 CVEs |
before 78.11.0-8.43.1 | 78.11.0-8.43.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-29951 is a medium vulnerability (CVSS 6.5) in Mozilla Firefox, published June 4, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.85%, the 79th percentile. Fixed in thunderbird 91.3.2-r0.
References
mozilla.org/security/advisories/mfsa2021-10
bugzilla.mozilla.org/show_bug.cgi?id=1690062
nvd.nist.gov/vuln/detail/CVE-2021-29951
github.com/advisories/GHSA-rc27-w7x3-jmp4
Show 20 moreShow less
security.alpinelinux.org/vuln/CVE-2021-29951
suse.com/support/update/announcement/2021/suse-su-202114743-1
bugzilla.suse.com/1185633
lists.opensuse.org/archives/list/[email protected]/thread/E2JRSLMFXKIDH3M3V6MCQ6BEUR3XMG5L