CVE-2021-29976: 
NixOS vulnerability analysis and mitigation

CVE-2021-29976 is a memory safety vulnerability discovered in Mozilla Firefox and Thunderbird. The vulnerability was disclosed on July 13, 2021, affecting Firefox versions < 90.0, Firefox ESR < 78.12, and Thunderbird < 78.12. Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird that showed evidence of memory corruption (Mozilla Advisory).

The vulnerability is classified as a memory safety bug with a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue stems from memory corruption bugs in shared code between Firefox and Thunderbird. The vulnerability is categorized as CWE-787 (Out-of-bounds Write) (NVD).

The vulnerability could potentially allow attackers to execute arbitrary code on affected systems. The memory corruption issues could be exploited with sufficient effort to compromise system security, potentially leading to remote code execution (Mozilla Advisory, Mozilla Advisory).

The vulnerability was patched in Firefox 90.0, Firefox ESR 78.12, and Thunderbird 78.12. Users are advised to upgrade to these versions or later to mitigate the risk. The fixes were released as part of Mozilla's regular security updates (Gentoo Advisory, Mozilla Advisory).