ArchLinux: 202109-2: firefox: multiple issues

Advisories

Arch Linux Security Advisory ASA-202109-2
=========================================

Severity: High
Date    : 2021-09-14
CVE-ID  : CVE-2021-38491 CVE-2021-38494
Package : firefox
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2350

Summary
=======

The package firefox before version 92.0-1 is vulnerable to multiple
issues including arbitrary code execution and insufficient validation.

Resolution
==========

Upgrade to 92.0-1.

# pacman -Syu "firefox>=92.0-1"

The problems have been fixed upstream in version 92.0.

Workaround
==========

None.

Description
===========

- CVE-2021-38491 (insufficient validation)

In Firefox before version 92, mixed-content checks were unable to
analyze opaque origins which led to some mixed content being loaded.

- CVE-2021-38494 (arbitrary code execution)

Mozilla developers reported memory safety bugs present in Firefox 91.
Some of these bugs showed evidence of memory corruption and Mozilla
presumes that with enough effort some of these could have been
exploited to run arbitrary code.

Impact
======

A remote attacker could execute arbitrary code through crafted web
content, or load content over HTTP on a web page otherwise served
through HTTPS.

References
==========

https://www.mozilla.org/security/advisories/mfsa2021-38/
https://bugzilla.mozilla.org/show_bug.cgi?id=1551886
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1723920%2C1725638
https://security.archlinux.org/CVE-2021-38491
https://security.archlinux.org/CVE-2021-38494

ArchLinux: 202109-2: firefox: multiple issues

September 15, 2021
The package firefox before version 92.0-1 is vulnerable to multiple issues including arbitrary code execution and insufficient validation

Summary

- CVE-2021-38491 (insufficient validation)
In Firefox before version 92, mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded.
- CVE-2021-38494 (arbitrary code execution)
Mozilla developers reported memory safety bugs present in Firefox 91. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code.

Resolution

Upgrade to 92.0-1.
# pacman -Syu "firefox>=92.0-1"
The problems have been fixed upstream in version 92.0.

References

https://www.mozilla.org/security/advisories/mfsa2021-38/ https://bugzilla.mozilla.org/show_bug.cgi?id=1551886 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1723920%2C1725638 https://security.archlinux.org/CVE-2021-38491 https://security.archlinux.org/CVE-2021-38494

Severity
CVE-ID : CVE-2021-38491 CVE-2021-38494
Package : firefox
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-2350

Impact

A remote attacker could execute arbitrary code through crafted web content, or load content over HTTP on a web page otherwise served through HTTPS.

Workaround

None.

Related News

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.