ArchLinux: 202108-14: firefox: multiple issues
Summary
- CVE-2021-29980 (arbitrary code execution)
A security issue has been found in Firefox before version 91 and
Thunderbird before version 78.13. Uninitialized memory in a canvas
object could have caused an incorrect free() leading to memory
corruption and a potentially exploitable crash.
- CVE-2021-29981 (arbitrary code execution)
A security issue has been found in Firefox and Thunderbird before
version 91. An issue present in lowering/register allocation could have
led to obscure but deterministic register confusion failures in JITted
code that would lead to a potentially exploitable crash.
- CVE-2021-29982 (information disclosure)
A security issue has been found in Firefox and Thunderbird before
version 91. Due to incorrect JIT optimization, it incorrectly
interpreted data from the wrong type of object, resulting in the
potential leak of a single bit of memory.
- CVE-2021-29984 (arbitrary code execution)
A security issue has been found in Firefox before version 91 and
Thunderbird before version 78.13. Instruction reordering resulted in a
sequence of instructions that would cause an object to be incorrectly
considered during garbage collection. This led to memory corruption and
a potentially exploitable crash.
- CVE-2021-29985 (arbitrary code execution)
A security issue has been found in Firefox before version 91 and
Thunderbird before version 78.13. A use-after-free vulnerability in
media channels could have led to memory corruption and a potentially
exploitable crash.
- CVE-2021-29986 (arbitrary code execution)
A security issue has been found in Firefox before version 91 and
Thunderbird before version 78.13. A suspected race condition when
calling getaddrinfo() led to memory corruption and a potentially
exploitable crash.
- CVE-2021-29987 (content spoofing)
A security issue has been found in Firefox and Thunderbird before
version 91. After requesting multiple permissions, and closing the
first permission panel, subsequent permission panels will be displayed
in a different position but still record a click in the default
location, making it possible to trick a user into accepting a
permission they did not want to.
- CVE-2021-29988 (arbitrary code execution)
Firefox before version 91 and Thunderbird before version 78.13
incorrectly treated an inline list-item element as a block element,
resulting in an out of bounds read or memory corruption, and a
potentially exploitable crash.
- CVE-2021-29989 (arbitrary code execution)
Mozilla developers reported memory safety bugs present in Firefox 90
and Thunderbird 78.12. Some of these bugs showed evidence of memory
corruption and Mozilla presumes that with enough effort some of these
could have been exploited to run arbitrary code.
- CVE-2021-29990 (arbitrary code execution)
Mozilla developers and community members reported memory safety bugs
present in Firefox 90. Some of these bugs showed evidence of memory
corruption and Mozilla presumes that with enough effort some of these
could have been exploited to run arbitrary code.
Resolution
Upgrade to 91.0-1.
# pacman -Syu "firefox>=91.0-1"
The problems have been fixed upstream in version 91.0.
References
https://www.mozilla.org/en-US/security/advisories/mfsa2021-33/ https://www.mozilla.org/en-US/security/advisories/mfsa2021-35/ https://bugzilla.mozilla.org/show_bug.cgi?id=1722204 https://www.mozilla.org/en-US/security/advisories/mfsa2021-36/ https://bugzilla.mozilla.org/show_bug.cgi?id=1707774 https://bugzilla.mozilla.org/show_bug.cgi?id=1715318 https://bugzilla.mozilla.org/show_bug.cgi?id=1720031 https://bugzilla.mozilla.org/show_bug.cgi?id=1722083 https://bugzilla.mozilla.org/show_bug.cgi?id=1696138 https://bugzilla.mozilla.org/show_bug.cgi?id=1716129 https://bugzilla.mozilla.org/show_bug.cgi?id=1717922 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662676%2C1666184%2C1719178%2C1719998%2C1720568 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1544190%2C1716481%2C1717778%2C1719319%2C1722073 https://security.archlinux.org/CVE-2021-29980 https://security.archlinux.org/CVE-2021-29981 https://security.archlinux.org/CVE-2021-29982 https://security.archlinux.org/CVE-2021-29984 https://security.archlinux.org/CVE-2021-29985 https://security.archlinux.org/CVE-2021-29986 https://security.archlinux.org/CVE-2021-29987 https://security.archlinux.org/CVE-2021-29988 https://security.archlinux.org/CVE-2021-29989 https://security.archlinux.org/CVE-2021-29990
Workaround
None.
