[manjaro-security] [ASA-202102-1] firefox: multiple issues

Fri Feb 12 07:57:35 CET 2021

Arch Linux Security Advisory ASA-202102-1
=========================================

Severity: High
Date    : 2021-02-01
CVE-ID  : CVE-2021-23953 CVE-2021-23954 CVE-2021-23955 CVE-2021-23956
           CVE-2021-23958 CVE-2021-23960 CVE-2021-23961 CVE-2021-23962
           CVE-2021-23963 CVE-2021-23964 CVE-2021-23965
Package : firefox
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1492

Summary
=======

The package firefox before version 85.0-1 is vulnerable to multiple
issues including arbitrary code execution, incorrect calculation and
information disclosure.

Resolution
==========

Upgrade to 85.0-1.

# pacman -Syu "firefox>=85.0-1"

The problems have been fixed upstream in version 85.0.

Workaround
==========

None.

Description
===========

- CVE-2021-23953 (information disclosure)

A security issue was found in Firefox before version 85.0 and
Thunderbird before version 78.7. If a user clicked into a specifically
crafted PDF, the PDF reader could be confused into leaking cross-origin
information, when said information is served as chunked data.

- CVE-2021-23954 (arbitrary code execution)

A security issue was found in Firefox before version 85.0 and
Thunderbird before version 78.7. Using the new logical assignment
operators in a JavaScript switch statement could have caused a type
confusion, leading to a memory corruption and a potentially exploitable
crash.

- CVE-2021-23955 (incorrect calculation)

A security issue was found in Firefox before version 85.0. The browser
could have been confused into transferring a pointer lock state into
another tab, which could have lead to clickjacking attacks.

- CVE-2021-23956 (information disclosure)

A security issue was found in Firefox before version 85.0. An ambiguous
file picker design could have confused users who intended to select and
upload a single file into uploading a whole directory. This was
addressed by adding a new prompt.

- CVE-2021-23958 (information disclosure)

A security issue was found in Firefox before version 85.0. The browser
could have been confused into transferring a screen sharing state into
another tab, which would leak unintended information.

- CVE-2021-23960 (arbitrary code execution)

A security issue was found in Firefox before version 85.0 and
Thunderbird before version 78.7. Performing garbage collection on re-
declared JavaScript variables resulted in a use-after-poison, and a
potentially exploitable crash.

- CVE-2021-23961 (information disclosure)

A security issue was found in Firefox before version 85.0. Further
techniques that built on the slipstream research combined with a
malicious webpage could have exposed both an internal network's hosts
as well as services running on the user's local machine.

- CVE-2021-23962 (arbitrary code execution)

A security issue was found in Firefox before version 85.0. Incorrect
use of the RowCountChanged method could have led to a use-after-poison
and a potentially exploitable crash.

- CVE-2021-23963 (incorrect calculation)

A security issue was found in Firefox before version 85.0. When sharing
geolocation during an active WebRTC share, Firefox could have reset the
webRTC sharing state in the user interface, leading to loss of control
over the currently granted permission.

- CVE-2021-23964 (arbitrary code execution)

A security issue was found in Firefox before version 85.0 and
Thunderbird before version 78.7. Mozilla developers reported memory
safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these
bugs showed evidence of memory corruption and Mozilla presumes that
with enough effort some of these could have been exploited to run
arbitrary code.

- CVE-2021-23965 (arbitrary code execution)

A security issue was found in Firefox before version 85.0. Mozilla
developers reported memory safety bugs present in Firefox 84. Some of
these bugs showed evidence of memory corruption and Mozilla presumes
that with enough effort some of these could have been exploited to run
arbitrary code.

Impact
======

A remote attacker might be able to perform click-jacking attacks,
access sensitive information or execute arbitrary code.

References
==========

https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23953
https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23953
https://bugzilla.mozilla.org/show_bug.cgi?id=1683940
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23954
https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23954
https://bugzilla.mozilla.org/show_bug.cgi?id=1684020
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23955
https://bugzilla.mozilla.org/show_bug.cgi?id=1684837
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23956
https://bugzilla.mozilla.org/show_bug.cgi?id=1338637
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23958
https://bugzilla.mozilla.org/show_bug.cgi?id=1642747
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23960
https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23960
https://bugzilla.mozilla.org/show_bug.cgi?id=1675755
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23961
https://bugzilla.mozilla.org/show_bug.cgi?id=1677940
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23962
https://bugzilla.mozilla.org/show_bug.cgi?id=1677194
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23963
https://bugzilla.mozilla.org/show_bug.cgi?id=1680793
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23964
https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23964
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662507%2C1666285%2C1673526%2C1674278%2C1674835%2C1675097%2C1675844%2C1675868%2C1677590%2C1677888%2C1680410%2C1681268%2C1682068%2C1682938%2C1683736%2C1685260%2C1685925
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23965
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1670378%2C1673555%2C1676812%2C1678582%2C1684497
https://security.archlinux.org/CVE-2021-23953
https://security.archlinux.org/CVE-2021-23954
https://security.archlinux.org/CVE-2021-23955
https://security.archlinux.org/CVE-2021-23956
https://security.archlinux.org/CVE-2021-23958
https://security.archlinux.org/CVE-2021-23960
https://security.archlinux.org/CVE-2021-23961
https://security.archlinux.org/CVE-2021-23962
https://security.archlinux.org/CVE-2021-23963
https://security.archlinux.org/CVE-2021-23964
https://security.archlinux.org/CVE-2021-23965

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://lists.manjaro.org/pipermail/manjaro-security/attachments/20210212/8607144e/attachment.sig>