Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
198
security advisoryhigh severityarbitrary code executionArch Linux: 202104-3 High Severity: Firefox Multiple Security Issues
The package firefox before version 88.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, arbitrary command execution, sandbox escape and access restriction bypass. . Arch Linux Security Advisory ASA-202104-3 ======================================== Severity: High Date : 2021-04-29 CVE-ID : CVE-2021-23994 CVE-2021-23995 CVE-2021-23996 CVE-2021-23997 CVE-2021-23998 CVE-2021-23999 CVE-2021-24000 CVE-2021-24001 CVE-2021-24002 CVE-2021-29946 CVE-2021-29947 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1834 Summary ====== The package firefox before version 88.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, arbitrary command execution, sandbox escape and access restriction bypass. Resolution ========= Upgrade to 88.0-1. # pacman -Syu "firefox> =88.0-1" The problems have been fixed upstream in version 88.0. Workaround ========= None. Description ========== - CVE-2021-23994 (arbitrary code execution) A security issue has been found in Firefox before version 88 and Thunderbird before version 78.10. A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bounds write. - CVE-2021-23995 (arbitrary code execution) A security issue has been found in Firefox before version 88 and Thunderbird before version 78.10. When Responsive Design Mode was enabled, it used references to objects that were previously freed. Mozilla presumes that with enough effort this could have been exploited to run arbitrary code. - CVE-2021-23996 (content spoofing) A security issue has been found in Firefox before version 88. By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing attack that could have been used for phishing or other attacks on a user. - CVE-2021-23997 (arbitrary code execution) A security issue has been found in Firefox before version88. Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. Mozilla presumes that with enough effort this could have been exploited to run arbitrary code. - CVE-2021-23998 (content spoofing) A security issue has been found in Firefox before version 88 and Thunderbird before version 78.10. Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. - CVE-2021-23999 (sandbox escape) A security issue has been found in Firefox before version 88 and Thunderbird before version 78.10. If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. - CVE-2021-24000 (content spoofing) A security issue has been found in Firefox before version 88. A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they were on a separate tab. In conjunction with certain elements (such as ) this could have led to an attack where a user was confused about the origin of the webpage and potentially disclosed information they did not intend to. - CVE-2021-24001 (sandbox escape) A security issue has been found in Firefox before version 88. A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations. - CVE-2021-24002 (arbitrary command execution) A security issue has been found in Firefox before version 88 and Thunderbird before version 78.10. When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. - CVE-2021-29946 (access restriction bypass) A security issue has been found in Firefox before version 88 and Thunderbird before version78.10. Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. - CVE-2021-29947 (arbitrary code execution) A security issue has been found in Firefox before version 88. Mozilla developers and community members reported memory safety bugs present in Firefox 87. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ===== An attacker is able to execute arbitrary code, spoof context, escape the sandbox, and bypass port blocking restrictions throughvarious means. References ========= https://www.mozilla.org/en-US/security/advisories/mfsa2021-16/#CVE-2021-23994 https://www.mozilla.org/en-US/security/advisories/mfsa2021-14/#CVE-2021-23994 https://bugzilla.mozilla.org/show_bug.cgi?id=1699077 https://www.mozilla.org/en-US/security/advisories/mfsa2021-16/#CVE-2021-23995 https://www.mozilla.org/en-US/security/advisories/mfsa2021-14/#CVE-2021-23995 https://bugzilla.mozilla.org/show_bug.cgi?id=1699835 https://www.mozilla.org/en-US/security/advisories/mfsa2021-16/#CVE-2021-23996 https://bugzilla.mozilla.org/show_bug.cgi?id=1701834 https://www.mozilla.org/en-US/security/advisories/mfsa2021-16/#CVE-2021-23997 https://bugzilla.mozilla.org/show_bug.cgi?id=1701942 https://www.mozilla.org/en-US/security/advisories/mfsa2021-16/#CVE-2021-23998 https://www.mozilla.org/en-US/security/advisories/mfsa2021-14/#CVE-2021-23998 https://bugzilla.mozilla.org/show_bug.cgi?id=1667456 https://www.mozilla.org/en-US/security/advisories/mfsa2021-16/#CVE-2021-23999 https://www.mozilla.org/en-US/security/advisories/mfsa2021-14/#CVE-2021-23999 https://bugzilla.mozilla.org/show_bug.cgi?id=1691153 https://www.mozilla.org/en-US/security/advisories/mfsa2021-16/#CVE-2021-24000 https://bugzilla.mozilla.org/show_bug.cgi?id=1694698 https://www.mozilla.org/en-US/security/advisories/mfsa2021-16/#CVE-2021-24001 https://bugzilla.mozilla.org/show_bug.cgi?id=1694727 https://www.mozilla.org/en-US/security/advisories/mfsa2021-16/#CVE-2021-24002 https://www.mozilla.org/en-US/security/advisories/mfsa2021-14/#CVE-2021-24002 https://bugzilla.mozilla.org/show_bug.cgi?id=1702374 https://www.mozilla.org/en-US/security/advisories/mfsa2021-16/#CVE-2021-29946 https://www.mozilla.org/en-US/security/advisories/mfsa2021-14/#CVE-2021-29946 https://bugzilla.mozilla.org/show_bug.cgi?id=1698503 https://www.mozilla.org/en-US/security/advisories/mfsa2021-16/#CVE-2021-29947 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1651449%2C1674142%2C1693476%2C1696886%2C1700091 https://security.archlinux.org/CVE-2021-23994 https://security.archlinux.org/CVE-2021-23995 https://security.archlinux.org/CVE-2021-23996 https://security.archlinux.org/CVE-2021-23997 https://security.archlinux.org/CVE-2021-23998 https://security.archlinux.org/CVE-2021-23999 https://security.archlinux.org/CVE-2021-24000 https://security.archlinux.org/CVE-2021-24001 https://security.archlinux.org/CVE-2021-24002 https://security.archlinux.org/CVE-2021-29946 https://security.archlinux.org/CVE-2021-29947 . Uncover several critical vulnerabilities in Firefox tailored for Arch Linux, encompassing execution errors and unauthorized access incidents.. Firefox Flaws, Arch Linux Advisory, Security Issues, Arbitrary Code Risks, High Severity Security. . LinuxSecurity.com Team
Apr 29, 2021
ArchLinux
89
security advisorycriticalFedoraFedora 10: 2009-2422 Critical Update: Gecko-Sharp2 Firefox Issues
Update to the new upstream Firefox 3.0.7 / XULRunner 1.9.0.7 fixing multiple security issues: https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-3.0/ This update also contains new builds of all applications depending on Gecko libraries, built against the new version. Note: after the updated packages are installed, Firefox must be restarted for the update to take effect.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2009-2422 2009-03-08 06:09:09 --------------------------------------------------------------------------------Name : gecko-sharp2 Product : Fedora 10 Version : 0.13 Release : 5.fc10 URL : https://www.mono-project.com/ Summary : Gecko bindings for Mono Description : This package provides Mono bindings for the Gecko engine, through an easy-to-use widget that will allow you to embed a Mozilla browser window into your Gtk# application. --------------------------------------------------------------------------------Update Information: Update to the new upstream Firefox 3.0.7 / XULRunner 1.9.0.7 fixing multiple security issues: https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-3.0/ This update also contains new builds of all applications depending on Gecko libraries, built against the new version. Note: after the updated packages are installed, Firefox must be restarted for the update to take effect. --------------------------------------------------------------------------------ChangeLog: * Fri Mar 6 2009 Jan Horak - 0.13-5 - Rebuild against newer gecko * Wed Feb 4 2009 Christopher Aillon - 0.13-4 - Rebuild against newer gecko * Wed Dec 17 2008 Christopher Aillon - 0.13-3 - Rebuild against newer gecko --------------------------------------------------------------------------------References: [ 1 ] Bug #488272 - CVE-2009-0771 Firefox 3 Layout Engine Crashes https://bugzilla.redhat.com/show_bug.cgi?id=488272 [ 2 ] Bug #488273 - CVE-2009-0772 Firefox 2 and 3 - Layout engine crashes https://bugzilla.redhat.com/show_bug.cgi?id=488273 [ 3 ] Bug #488276 - CVE-2009-0773 Firefox 3 crashes in the JavaScript engine https://bugzilla.redhat.com/show_bug.cgi?id=488276 [ 4 ] Bug #488283 - CVE-2009-0774 Firefox 2 and 3 crashes in the JavaScript engine https://bugzilla.redhat.com/show_bug.cgi?id=488283 [ 5 ] Bug #488287 - CVE-2009-0775 Firefox XUL Linked Clones Double Free Vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=488287 [ 6 ] Bug #488290 - CVE-2009-0776 Firefox XML data theft via RDFXMLDataSource and cross-domain redirect https://bugzilla.redhat.com/show_bug.cgi?id=488290 [ 7 ] Bug #488292 - CVE-2009-0777 Firefox URL spoofing with invisible control characters https://bugzilla.redhat.com/show_bug.cgi?id=488292 --------------------------------------------------------------------------------This update can be installed with the "yum" update program. Use su -c 'yum update gecko-sharp2' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ Fedora-package-announce mailing list
Mar 08, 2009
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!