ArchLinux: 202108-14: firefox: multiple issues

Advisories

Arch Linux Security Advisory ASA-202108-14
==========================================

Severity: High
Date    : 2021-08-11
CVE-ID  : CVE-2021-29980 CVE-2021-29981 CVE-2021-29982 CVE-2021-29984
          CVE-2021-29985 CVE-2021-29986 CVE-2021-29987 CVE-2021-29988
          CVE-2021-29989 CVE-2021-29990
Package : firefox
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2269

Summary
=======

The package firefox before version 91.0-1 is vulnerable to multiple
issues including arbitrary code execution, content spoofing and
information disclosure.

Resolution
==========

Upgrade to 91.0-1.

# pacman -Syu "firefox>=91.0-1"

The problems have been fixed upstream in version 91.0.

Workaround
==========

None.

Description
===========

- CVE-2021-29980 (arbitrary code execution)

A security issue has been found in Firefox before version 91 and
Thunderbird before version 78.13. Uninitialized memory in a canvas
object could have caused an incorrect free() leading to memory
corruption and a potentially exploitable crash.

- CVE-2021-29981 (arbitrary code execution)

A security issue has been found in Firefox and Thunderbird before
version 91. An issue present in lowering/register allocation could have
led to obscure but deterministic register confusion failures in JITted
code that would lead to a potentially exploitable crash.

- CVE-2021-29982 (information disclosure)

A security issue has been found in Firefox and Thunderbird before
version 91. Due to incorrect JIT optimization, it incorrectly
interpreted data from the wrong type of object, resulting in the
potential leak of a single bit of memory.

- CVE-2021-29984 (arbitrary code execution)

A security issue has been found in Firefox before version 91 and
Thunderbird before version 78.13. Instruction reordering resulted in a
sequence of instructions that would cause an object to be incorrectly
considered during garbage collection. This led to memory corruption and
a potentially exploitable crash.

- CVE-2021-29985 (arbitrary code execution)

A security issue has been found in Firefox before version 91 and
Thunderbird before version 78.13. A use-after-free vulnerability in
media channels could have led to memory corruption and a potentially
exploitable crash.

- CVE-2021-29986 (arbitrary code execution)

A security issue has been found in Firefox before version 91 and
Thunderbird before version 78.13. A suspected race condition when
calling getaddrinfo() led to memory corruption and a potentially
exploitable crash.

- CVE-2021-29987 (content spoofing)

A security issue has been found in Firefox and Thunderbird before
version 91. After requesting multiple permissions, and closing the
first permission panel, subsequent permission panels will be displayed
in a different position but still record a click in the default
location, making it possible to trick a user into accepting a
permission they did not want to.

- CVE-2021-29988 (arbitrary code execution)

Firefox before version 91 and Thunderbird before version 78.13
incorrectly treated an inline list-item element as a block element,
resulting in an out of bounds read or memory corruption, and a
potentially exploitable crash.

- CVE-2021-29989 (arbitrary code execution)

Mozilla developers reported memory safety bugs present in Firefox 90
and Thunderbird 78.12. Some of these bugs showed evidence of memory
corruption and Mozilla presumes that with enough effort some of these
could have been exploited to run arbitrary code.

- CVE-2021-29990 (arbitrary code execution)

Mozilla developers and community members reported memory safety bugs
present in Firefox 90. Some of these bugs showed evidence of memory
corruption and Mozilla presumes that with enough effort some of these
could have been exploited to run arbitrary code.

Impact
======

A remote attacker could execute arbitrary code or trick the user into
accepting additional site permissions through maliciously crafted web
content.

References
==========

https://www.mozilla.org/security/advisories/mfsa2021-33/
https://www.mozilla.org/security/advisories/mfsa2021-35/
https://bugzilla.mozilla.org/show_bug.cgi?id=1722204
https://www.mozilla.org/security/advisories/mfsa2021-36/
https://bugzilla.mozilla.org/show_bug.cgi?id=1707774
https://bugzilla.mozilla.org/show_bug.cgi?id=1715318
https://bugzilla.mozilla.org/show_bug.cgi?id=1720031
https://bugzilla.mozilla.org/show_bug.cgi?id=1722083
https://bugzilla.mozilla.org/show_bug.cgi?id=1696138
https://bugzilla.mozilla.org/show_bug.cgi?id=1716129
https://bugzilla.mozilla.org/show_bug.cgi?id=1717922
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662676%2C1666184%2C1719178%2C1719998%2C1720568
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1544190%2C1716481%2C1717778%2C1719319%2C1722073
https://security.archlinux.org/CVE-2021-29980
https://security.archlinux.org/CVE-2021-29981
https://security.archlinux.org/CVE-2021-29982
https://security.archlinux.org/CVE-2021-29984
https://security.archlinux.org/CVE-2021-29985
https://security.archlinux.org/CVE-2021-29986
https://security.archlinux.org/CVE-2021-29987
https://security.archlinux.org/CVE-2021-29988
https://security.archlinux.org/CVE-2021-29989
https://security.archlinux.org/CVE-2021-29990

ArchLinux: 202108-14: firefox: multiple issues

August 13, 2021
The package firefox before version 91.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and information disclosure

Summary

- CVE-2021-29980 (arbitrary code execution)
A security issue has been found in Firefox before version 91 and Thunderbird before version 78.13. Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash.
- CVE-2021-29981 (arbitrary code execution)
A security issue has been found in Firefox and Thunderbird before version 91. An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that would lead to a potentially exploitable crash.
- CVE-2021-29982 (information disclosure)
A security issue has been found in Firefox and Thunderbird before version 91. Due to incorrect JIT optimization, it incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a single bit of memory.
- CVE-2021-29984 (arbitrary code execution)
A security issue has been found in Firefox before version 91 and Thunderbird before version 78.13. Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection. This led to memory corruption and a potentially exploitable crash.
- CVE-2021-29985 (arbitrary code execution)
A security issue has been found in Firefox before version 91 and Thunderbird before version 78.13. A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash.
- CVE-2021-29986 (arbitrary code execution)
A security issue has been found in Firefox before version 91 and Thunderbird before version 78.13. A suspected race condition when calling getaddrinfo() led to memory corruption and a potentially exploitable crash.
- CVE-2021-29987 (content spoofing)
A security issue has been found in Firefox and Thunderbird before version 91. After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default location, making it possible to trick a user into accepting a permission they did not want to.
- CVE-2021-29988 (arbitrary code execution)
Firefox before version 91 and Thunderbird before version 78.13 incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash.
- CVE-2021-29989 (arbitrary code execution)
Mozilla developers reported memory safety bugs present in Firefox 90 and Thunderbird 78.12. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code.
- CVE-2021-29990 (arbitrary code execution)
Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code.

Resolution

Upgrade to 91.0-1.
# pacman -Syu "firefox>=91.0-1"
The problems have been fixed upstream in version 91.0.

References

https://www.mozilla.org/security/advisories/mfsa2021-33/ https://www.mozilla.org/security/advisories/mfsa2021-35/ https://bugzilla.mozilla.org/show_bug.cgi?id=1722204 https://www.mozilla.org/security/advisories/mfsa2021-36/ https://bugzilla.mozilla.org/show_bug.cgi?id=1707774 https://bugzilla.mozilla.org/show_bug.cgi?id=1715318 https://bugzilla.mozilla.org/show_bug.cgi?id=1720031 https://bugzilla.mozilla.org/show_bug.cgi?id=1722083 https://bugzilla.mozilla.org/show_bug.cgi?id=1696138 https://bugzilla.mozilla.org/show_bug.cgi?id=1716129 https://bugzilla.mozilla.org/show_bug.cgi?id=1717922 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662676%2C1666184%2C1719178%2C1719998%2C1720568 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1544190%2C1716481%2C1717778%2C1719319%2C1722073 https://security.archlinux.org/CVE-2021-29980 https://security.archlinux.org/CVE-2021-29981 https://security.archlinux.org/CVE-2021-29982 https://security.archlinux.org/CVE-2021-29984 https://security.archlinux.org/CVE-2021-29985 https://security.archlinux.org/CVE-2021-29986 https://security.archlinux.org/CVE-2021-29987 https://security.archlinux.org/CVE-2021-29988 https://security.archlinux.org/CVE-2021-29989 https://security.archlinux.org/CVE-2021-29990

Severity
CVE-ID : CVE-2021-29980 CVE-2021-29981 CVE-2021-29982 CVE-2021-29984
CVE-2021-29985 CVE-2021-29986 CVE-2021-29987 CVE-2021-29988
CVE-2021-29989 CVE-2021-29990
Package : firefox
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-2269

Impact

A remote attacker could execute arbitrary code or trick the user into accepting additional site permissions through maliciously crafted web content.

Workaround

None.

Related News

© 2022 Guardian Digital, Inc All Rights Reserved

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.