Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Mageia 8: 2021-0425 Moderate: Firefox Memory Safety Concerns

mageia
Calendar Grey September 23, 2021
Dist Mageia Esm H88
Recent changes to Firefox packages enhance memory safety issues, mitigating risks of possible exploitation. Check out the resolution in Mageia 8's notification.
Mozilla developers Tyson Smith and Gabriele Svelto reported memory safety bugs present in Firefox ESR 78.13

Summary

Mozilla developers Tyson Smith and Gabriele Svelto reported memory safety bugs present in Firefox ESR 78.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2021-38493).
The firefox package has been updated to the 91ESR branch. See the upstream release notes for details.

References

- https://bugs.mageia.org/show_bug.cgi?id=29373

- https://www.mozilla.org/en-US/security/advisories/mfsa2021-39/

- https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_69_1.html

- https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_70.html

- https://support.mozilla.org/en-US/kb/firefox-enterprise-91-release-notes

- https://www.firefox.com/en-US/firefox/91.0esr/releasenotes/?redirect_source=mozilla-org

- https://www.firefox.com/en-US/firefox/91.0.1esr/releasenotes/?redirect_source=mozilla-org

- https://www.cve.org/CVERecord?id=CVE-2021-38493

Topics%20covered

Topics Covered

security advisory update arbitrary code execution memory corruption Firefox Mageia

Resolution

SRPMS

- 8/core/firefox-91.1.0-1.mga8

- 8/core/firefox-l10n-91.1.0-1.mga8

- 8/core/nss-3.70.0-1.mga8

Publication date: 23 Sep 2021
URL: https://advisories.mageia.org/MGASA-2021-0425.html
Type: security
CVE: CVE-2021-38493

Topics%20covered

Topics Covered

security advisory update arbitrary code execution memory corruption Firefox Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here