ArchLinux: 202102-1: firefox: multiple issues
Summary
- CVE-2021-23953 (information disclosure)
A security issue was found in Firefox before version 85.0 and
Thunderbird before version 78.7. If a user clicked into a specifically
crafted PDF, the PDF reader could be confused into leaking cross-origin
information, when said information is served as chunked data.
- CVE-2021-23954 (arbitrary code execution)
A security issue was found in Firefox before version 85.0 and
Thunderbird before version 78.7. Using the new logical assignment
operators in a JavaScript switch statement could have caused a type
confusion, leading to a memory corruption and a potentially exploitable
crash.
- CVE-2021-23955 (incorrect calculation)
A security issue was found in Firefox before version 85.0. The browser
could have been confused into transferring a pointer lock state into
another tab, which could have lead to clickjacking attacks.
- CVE-2021-23956 (information disclosure)
A security issue was found in Firefox before version 85.0. An ambiguous
file picker design could have confused users who intended to select and
upload a single file into uploading a whole directory. This was
addressed by adding a new prompt.
- CVE-2021-23958 (information disclosure)
A security issue was found in Firefox before version 85.0. The browser
could have been confused into transferring a screen sharing state into
another tab, which would leak unintended information.
- CVE-2021-23960 (arbitrary code execution)
A security issue was found in Firefox before version 85.0 and
Thunderbird before version 78.7. Performing garbage collection on re-declared JavaScript variables resulted in a use-after-poison, and a
potentially exploitable crash.
- CVE-2021-23961 (information disclosure)
A security issue was found in Firefox before version 85.0. Further
techniques that built on the slipstream research combined with a
malicious webpage could have exposed both an internal network's hosts
as well as services running on the user's local machine.
- CVE-2021-23962 (arbitrary code execution)
A security issue was found in Firefox before version 85.0. Incorrect
use of the RowCountChanged method could have led to a use-after-poison
and a potentially exploitable crash.
- CVE-2021-23963 (incorrect calculation)
A security issue was found in Firefox before version 85.0. When sharing
geolocation during an active WebRTC share, Firefox could have reset the
webRTC sharing state in the user interface, leading to loss of control
over the currently granted permission.
- CVE-2021-23964 (arbitrary code execution)
A security issue was found in Firefox before version 85.0 and
Thunderbird before version 78.7. Mozilla developers reported memory
safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these
bugs showed evidence of memory corruption and Mozilla presumes that
with enough effort some of these could have been exploited to run
arbitrary code.
- CVE-2021-23965 (arbitrary code execution)
A security issue was found in Firefox before version 85.0. Mozilla
developers reported memory safety bugs present in Firefox 84. Some of
these bugs showed evidence of memory corruption and Mozilla presumes
that with enough effort some of these could have been exploited to run
arbitrary code.
Resolution
Upgrade to 85.0-1.
# pacman -Syu "firefox>=85.0-1"
The problems have been fixed upstream in version 85.0.
References
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23953 https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23953 https://bugzilla.mozilla.org/show_bug.cgi?id=1683940 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23954 https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23954 https://bugzilla.mozilla.org/show_bug.cgi?id=1684020 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23955 https://bugzilla.mozilla.org/show_bug.cgi?id=1684837 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23956 https://bugzilla.mozilla.org/show_bug.cgi?id=1338637 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23958 https://bugzilla.mozilla.org/show_bug.cgi?id=1642747 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23960 https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23960 https://bugzilla.mozilla.org/show_bug.cgi?id=1675755 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23961 https://bugzilla.mozilla.org/show_bug.cgi?id=1677940 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23962 https://bugzilla.mozilla.org/show_bug.cgi?id=1677194 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23963 https://bugzilla.mozilla.org/show_bug.cgi?id=1680793 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23964 https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23964 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662507%2C1666285%2C1673526%2C1674278%2C1674835%2C1675097%2C1675844%2C1675868%2C1677590%2C1677888%2C1680410%2C1681268%2C1682068%2C1682938%2C1683736%2C1685260%2C1685925 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23965 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1670378%2C1673555%2C1676812%2C1678582%2C1684497 https://security.archlinux.org/CVE-2021-23953 https://security.archlinux.org/CVE-2021-23954 https://security.archlinux.org/CVE-2021-23955 https://security.archlinux.org/CVE-2021-23956 https://security.archlinux.org/CVE-2021-23958 https://security.archlinux.org/CVE-2021-23960 https://security.archlinux.org/CVE-2021-23961 https://security.archlinux.org/CVE-2021-23962 https://security.archlinux.org/CVE-2021-23963 https://security.archlinux.org/CVE-2021-23964 https://security.archlinux.org/CVE-2021-23965
Workaround
None.
