Arch Linux Security Advisory ASA-202102-1 ========================================= Severity: High Date : 2021-02-01 CVE-ID : CVE-2021-23953 CVE-2021-23954 CVE-2021-23955 CVE-2021-23956 CVE-2021-23958 CVE-2021-23960 CVE-2021-23961 CVE-2021-23962 CVE-2021-23963 CVE-2021-23964 CVE-2021-23965 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1492 Summary ======= The package firefox before version 85.0-1 is vulnerable to multiple issues including arbitrary code execution, incorrect calculation and information disclosure. Resolution ========== Upgrade to 85.0-1. # pacman -Syu "firefox>=85.0-1" The problems have been fixed upstream in version 85.0. Workaround ========== None. Description =========== - CVE-2021-23953 (information disclosure) A security issue was found in Firefox before version 85.0 and Thunderbird before version 78.7. If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. - CVE-2021-23954 (arbitrary code execution) A security issue was found in Firefox before version 85.0 and Thunderbird before version 78.7. Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. - CVE-2021-23955 (incorrect calculation) A security issue was found in Firefox before version 85.0. The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks. - CVE-2021-23956 (information disclosure) A security issue was found in Firefox before version 85.0. An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. This was addressed by adding a new prompt. - CVE-2021-23958 (information disclosure) A security issue was found in Firefox before version 85.0. The browser could have been confused into transferring a screen sharing state into another tab, which would leak unintended information. - CVE-2021-23960 (arbitrary code execution) A security issue was found in Firefox before version 85.0 and Thunderbird before version 78.7. Performing garbage collection on re- declared JavaScript variables resulted in a use-after-poison, and a potentially exploitable crash. - CVE-2021-23961 (information disclosure) A security issue was found in Firefox before version 85.0. Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. - CVE-2021-23962 (arbitrary code execution) A security issue was found in Firefox before version 85.0. Incorrect use of the RowCountChanged method could have led to a use-after-poison and a potentially exploitable crash. - CVE-2021-23963 (incorrect calculation) A security issue was found in Firefox before version 85.0. When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission. - CVE-2021-23964 (arbitrary code execution) A security issue was found in Firefox before version 85.0 and Thunderbird before version 78.7. Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2021-23965 (arbitrary code execution) A security issue was found in Firefox before version 85.0. Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker might be able to perform click-jacking attacks, access sensitive information or execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23953 https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23953 https://bugzilla.mozilla.org/show_bug.cgi?id=1683940 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23954 https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23954 https://bugzilla.mozilla.org/show_bug.cgi?id=1684020 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23955 https://bugzilla.mozilla.org/show_bug.cgi?id=1684837 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23956 https://bugzilla.mozilla.org/show_bug.cgi?id=1338637 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23958 https://bugzilla.mozilla.org/show_bug.cgi?id=1642747 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23960 https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23960 https://bugzilla.mozilla.org/show_bug.cgi?id=1675755 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23961 https://bugzilla.mozilla.org/show_bug.cgi?id=1677940 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23962 https://bugzilla.mozilla.org/show_bug.cgi?id=1677194 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23963 https://bugzilla.mozilla.org/show_bug.cgi?id=1680793 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23964 https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23964 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662507%2C1666285%2C1673526%2C1674278%2C1674835%2C1675097%2C1675844%2C1675868%2C1677590%2C1677888%2C1680410%2C1681268%2C1682068%2C1682938%2C1683736%2C1685260%2C1685925 https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23965 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1670378%2C1673555%2C1676812%2C1678582%2C1684497 https://security.archlinux.org/CVE-2021-23953 https://security.archlinux.org/CVE-2021-23954 https://security.archlinux.org/CVE-2021-23955 https://security.archlinux.org/CVE-2021-23956 https://security.archlinux.org/CVE-2021-23958 https://security.archlinux.org/CVE-2021-23960 https://security.archlinux.org/CVE-2021-23961 https://security.archlinux.org/CVE-2021-23962 https://security.archlinux.org/CVE-2021-23963 https://security.archlinux.org/CVE-2021-23964 https://security.archlinux.org/CVE-2021-23965