- Arch-security - lists.archlinux.org

[ASA-202110-3] virtualbox: multiple issues
by Jonas Witschel 21 Oct '21

21 Oct '21

Arch Linux Security Advisory ASA-202110-3 ========================================= Severity: High Date : 2021-10-21 CVE-ID : CVE-2021-2475 CVE-2021-35538 CVE-2021-35540 CVE-2021-35542 CVE-2021-35545 Package : virtualbox Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-2476 Summary ======= The package virtualbox before version 6.1.28-1 is vulnerable to multiple issues including sandbox escape, denial of service and information disclosure. Resolution ========== Upgrade to 6.1.28-1. # pacman -Syu "virtualbox>=6.1.28-1" The problems have been fixed upstream in version 6.1.28. Workaround ========== None. Description =========== - CVE-2021-2475 (denial of service) A security issue has been found in Oracle VM VirtualBox before version 6.1.28. An easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-35538 (sandbox escape) A security issue has been found in Oracle VM VirtualBox before version 6.1.28. An easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2021-35540 (denial of service) A security issue has been found in Oracle VM VirtualBox before version 6.1.28. An easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-35542 (denial of service) A security issue has been found in Oracle VM VirtualBox before version 6.1.28. An easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-35545 (information disclosure) A security issue has been found in Oracle VM VirtualBox before version 6.1.28. An easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. Impact ====== A malicious virtual machine guest could escape its confinement to run arbitrary code on the host system, disclose sensitive information, or crash VirtualBox. References ========== https://www.oracle.com/security-alerts/cpuoct2021verbose.html#OVIR https://security.archlinux.org/CVE-2021-2475 https://security.archlinux.org/CVE-2021-35538 https://security.archlinux.org/CVE-2021-35540 https://security.archlinux.org/CVE-2021-35542 https://security.archlinux.org/CVE-2021-35545

1 0

[ASA-202110-2] chromium: multiple issues
by Jonas Witschel 21 Oct '21

21 Oct '21

Arch Linux Security Advisory ASA-202110-2 ========================================= Severity: High Date : 2021-10-21 CVE-ID : CVE-2021-37981 CVE-2021-37982 CVE-2021-37983 CVE-2021-37984 CVE-2021-37985 CVE-2021-37986 CVE-2021-37987 CVE-2021-37988 CVE-2021-37989 CVE-2021-37990 CVE-2021-37991 CVE-2021-37992 CVE-2021-37993 CVE-2021-37994 CVE-2021-37995 CVE-2021-37996 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2474 Summary ======= The package chromium before version 95.0.4638.54-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and insufficient validation. Resolution ========== Upgrade to 95.0.4638.54-1. # pacman -Syu "chromium>=95.0.4638.54-1" The problems have been fixed upstream in version 95.0.4638.54. Workaround ========== None. Description =========== - CVE-2021-37981 (arbitrary code execution) A heap buffer overflow security issue has been found in the Skia component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37982 (arbitrary code execution) A use after free security issue has been found in the Incognito component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37983 (arbitrary code execution) A use after free security issue has been found in the Dev Tools component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37984 (arbitrary code execution) A heap buffer overflow security issue has been found in the PDFium component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37985 (arbitrary code execution) A use after free security issue has been found in the V8 component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37986 (arbitrary code execution) A heap buffer overflow security issue has been found in the Settings component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37987 (arbitrary code execution) A use after free security issue has been found in the Network APIs component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37988 (arbitrary code execution) A use after free security issue has been found in the Profiles component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37989 (arbitrary code execution) An inappropriate implementation security issue has been found in the Blink component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37990 (arbitrary code execution) An inappropriate implementation security issue has been found in the WebView component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37991 (arbitrary code execution) A race security issue has been found in the V8 component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37992 (information disclosure) An out of bounds read security issue has been found in the WebAudio component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37993 (arbitrary code execution) A use after free security issue has been found in the PDF Accessibility component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37994 (arbitrary code execution) An inappropriate implementation security issue has been found in the iFrame Sandbox component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37995 (arbitrary code execution) An inappropriate implementation security issue has been found in the WebApp Installer component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37996 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the Downloads component of the Chromium browser engine before version 95.0.4638.54. Impact ====== A remote attacker could execute arbitrary code or disclose sensitive information through crafted web content. References ========== https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-des… https://crbug.com/1246631 https://crbug.com/1248661 https://crbug.com/1249810 https://crbug.com/1253399 https://crbug.com/1241860 https://crbug.com/1242404 https://crbug.com/1206928 https://crbug.com/1228248 https://crbug.com/1233067 https://crbug.com/1247395 https://crbug.com/1250660 https://crbug.com/1253746 https://crbug.com/1255332 https://crbug.com/1100761 https://crbug.com/1242315 https://crbug.com/1243020 https://security.archlinux.org/CVE-2021-37981 https://security.archlinux.org/CVE-2021-37982 https://security.archlinux.org/CVE-2021-37983 https://security.archlinux.org/CVE-2021-37984 https://security.archlinux.org/CVE-2021-37985 https://security.archlinux.org/CVE-2021-37986 https://security.archlinux.org/CVE-2021-37987 https://security.archlinux.org/CVE-2021-37988 https://security.archlinux.org/CVE-2021-37989 https://security.archlinux.org/CVE-2021-37990 https://security.archlinux.org/CVE-2021-37991 https://security.archlinux.org/CVE-2021-37992 https://security.archlinux.org/CVE-2021-37993 https://security.archlinux.org/CVE-2021-37994 https://security.archlinux.org/CVE-2021-37995 https://security.archlinux.org/CVE-2021-37996

1 0

[ASA-202110-1] apache: directory traversal
by Jonas Witschel 21 Oct '21

21 Oct '21

Arch Linux Security Advisory ASA-202110-1 ========================================= Severity: Critical Date : 2021-10-21 CVE-ID : CVE-2021-42013 Package : apache Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-2450 Summary ======= The package apache before version 2.4.51-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 2.4.51-1. # pacman -Syu "apache>=2.4.51-1" The problem has been fixed upstream in version 2.4.51. Workaround ========== None. Description =========== It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions. Impact ====== A remote attacker could trick the HTTP server into executing arbitrary executables in its file system through path traversal. References ========== https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-42013 https://twitter.com/roman_soft/status/1446252280597078024 https://github.com/icing/blog/blob/main/httpd-2.4.50.md https://svn.apache.org/viewvc?view=revision&revision=1893971 https://security.archlinux.org/CVE-2021-42013

1 0

[ASA-202109-6] chromium: arbitrary code execution
by Jonas Witschel 15 Sep '21

15 Sep '21

Arch Linux Security Advisory ASA-202109-6 ========================================= Severity: High Date : 2021-09-14 CVE-ID : CVE-2021-30625 CVE-2021-30626 CVE-2021-30627 CVE-2021-30628 CVE-2021-30629 CVE-2021-30630 CVE-2021-30631 CVE-2021-30632 CVE-2021-30633 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2379 Summary ======= The package chromium before version 93.0.4577.82-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 93.0.4577.82-1. # pacman -Syu "chromium>=93.0.4577.82-1" The problems have been fixed upstream in version 93.0.4577.82. Workaround ========== None. Description =========== - CVE-2021-30625 (arbitrary code execution) A use after free security issue has been found in the Selection API component of the Chromium browser engine before version 93.0.4577.82. - CVE-2021-30626 (arbitrary code execution) An out of bounds memory access security issue has been found in the ANGLE component of the Chromium browser engine before version 93.0.4577.82. - CVE-2021-30627 (arbitrary code execution) A type confusion security issue has been found in the Blink layout component of the Chromium browser engine before version 93.0.4577.82. - CVE-2021-30628 (arbitrary code execution) A stack buffer overflow security issue has been found in the ANGLE component of the Chromium browser engine before version 93.0.4577.82. - CVE-2021-30629 (arbitrary code execution) A use after free security issue has been found in the Permissions component of the Chromium browser engine before version 93.0.4577.82. - CVE-2021-30630 (arbitrary code execution) An inappropriate implementation security issue has been found in the Blink component of the Chromium browser engine before version 93.0.4577.82. - CVE-2021-30631 (arbitrary code execution) A type confusion security issue has been found in the Blink layout component of the Chromium browser engine before version 93.0.4577.82. - CVE-2021-30632 (arbitrary code execution) An out of bounds write security issue has been found in the V8 component of the Chromium browser engine before version 93.0.4577.82. Google is aware that exploits for this issue exist in the wild. - CVE-2021-30633 (arbitrary code execution) A use after free security issue has been found in the Indexed DB API component of the Chromium browser engine before version 93.0.4577.82. Google is aware that exploits for this issue exist in the wild. Impact ====== A remote attacker could execute arbitrary code through crafted web content. References ========== https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-des… https://crbug.com/1237533 https://crbug.com/1241036 https://crbug.com/1245786 https://crbug.com/1241123 https://crbug.com/1243646 https://crbug.com/1244568 https://crbug.com/1246932 https://crbug.com/1247763 https://crbug.com/1247766 https://security.archlinux.org/CVE-2021-30625 https://security.archlinux.org/CVE-2021-30626 https://security.archlinux.org/CVE-2021-30627 https://security.archlinux.org/CVE-2021-30628 https://security.archlinux.org/CVE-2021-30629 https://security.archlinux.org/CVE-2021-30630 https://security.archlinux.org/CVE-2021-30631 https://security.archlinux.org/CVE-2021-30632 https://security.archlinux.org/CVE-2021-30633

1 0

[ASA-202109-5] element-web: information disclosure
by Jonas Witschel 15 Sep '21

15 Sep '21

Arch Linux Security Advisory ASA-202109-5 ========================================= Severity: High Date : 2021-09-14 CVE-ID : CVE-2021-40823 Package : element-web Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2377 Summary ======= The package element-web before version 1.8.4-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.8.4-1. # pacman -Syu "element-web>=1.8.4-1" The problem has been fixed upstream in version 1.8.4. Workaround ========== None. Description =========== A security has been found in matrix-js-sdk before version 12.4.1, as used by Element Web/Desktop before version 1.8.4. In certain circumstances it may be possible to trick vulnerable clients into disclosing encryption keys for messages previously sent by that client to user accounts later compromised by an attacker. Exploiting this vulnerability to read encrypted messages requires gaining control over the recipient’s account. This requires either compromising their credentials directly or compromising their homeserver. Thus, the greatest risk is to users who are in encrypted rooms containing malicious servers. Admins of malicious servers could attempt to impersonate their users' devices in order to spy on messages sent by vulnerable clients in that room. Impact ====== A remote attacker able to compromise a user account could disclose encryption keys for messages previously sent by the Matrix client. References ========== https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing/ https://github.com/matrix-org/matrix-js-sdk/commit/894c24880da0e1cc81818f51… https://security.archlinux.org/CVE-2021-40823

1 0

[ASA-202109-4] element-desktop: information disclosure
by Jonas Witschel 15 Sep '21

15 Sep '21

Arch Linux Security Advisory ASA-202109-4 ========================================= Severity: High Date : 2021-09-14 CVE-ID : CVE-2021-40823 Package : element-desktop Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2377 Summary ======= The package element-desktop before version 1.8.4-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.8.4-1. # pacman -Syu "element-desktop>=1.8.4-1" The problem has been fixed upstream in version 1.8.4. Workaround ========== None. Description =========== A security has been found in matrix-js-sdk before version 12.4.1, as used by Element Web/Desktop before version 1.8.4. In certain circumstances it may be possible to trick vulnerable clients into disclosing encryption keys for messages previously sent by that client to user accounts later compromised by an attacker. Exploiting this vulnerability to read encrypted messages requires gaining control over the recipient’s account. This requires either compromising their credentials directly or compromising their homeserver. Thus, the greatest risk is to users who are in encrypted rooms containing malicious servers. Admins of malicious servers could attempt to impersonate their users' devices in order to spy on messages sent by vulnerable clients in that room. Impact ====== A remote attacker able to compromise a user account could disclose encryption keys for messages previously sent by the Matrix client. References ========== https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing/ https://github.com/matrix-org/matrix-js-sdk/commit/894c24880da0e1cc81818f51… https://security.archlinux.org/CVE-2021-40823

1 0

[ASA-202109-3] ghostscript: arbitrary command execution
by Jonas Witschel 15 Sep '21

15 Sep '21

Arch Linux Security Advisory ASA-202109-3 ========================================= Severity: High Date : 2021-09-14 CVE-ID : CVE-2021-3781 Package : ghostscript Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-2374 Summary ======= The package ghostscript before version 9.54.0-3 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 9.54.0-3. # pacman -Syu "ghostscript>=9.54.0-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A trivial sandbox (enabled with the -dSAFER option) escape security issue was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. Impact ====== An attacker could execute arbitrary commands through crafted documents, bypassing the interpreter's sandbox. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=2002271 https://bugs.ghostscript.com/show_bug.cgi?id=704342 https://twitter.com/emil_lerner/status/1430502815181463559 https://github.com/duc-nt/RCE-0-day-for-GhostScript-9.50 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a9bd3dec9fde0332… https://security.archlinux.org/CVE-2021-3781

1 0

[ASA-202109-2] firefox: multiple issues
by Jonas Witschel 15 Sep '21

15 Sep '21

Arch Linux Security Advisory ASA-202109-2 ========================================= Severity: High Date : 2021-09-14 CVE-ID : CVE-2021-38491 CVE-2021-38494 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2350 Summary ======= The package firefox before version 92.0-1 is vulnerable to multiple issues including arbitrary code execution and insufficient validation. Resolution ========== Upgrade to 92.0-1. # pacman -Syu "firefox>=92.0-1" The problems have been fixed upstream in version 92.0. Workaround ========== None. Description =========== - CVE-2021-38491 (insufficient validation) In Firefox before version 92, mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded. - CVE-2021-38494 (arbitrary code execution) Mozilla developers reported memory safety bugs present in Firefox 91. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker could execute arbitrary code through crafted web content, or load content over HTTP on a web page otherwise served through HTTPS. References ========== https://www.mozilla.org/security/advisories/mfsa2021-38/ https://bugzilla.mozilla.org/show_bug.cgi?id=1551886 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1723920%2C1725638 https://security.archlinux.org/CVE-2021-38491 https://security.archlinux.org/CVE-2021-38494

1 0

[ASA-202109-1] hedgedoc: cross-site scripting
by Jonas Witschel 15 Sep '21

15 Sep '21

Arch Linux Security Advisory ASA-202109-1 ========================================= Severity: High Date : 2021-09-14 CVE-ID : CVE-2021-39175 Package : hedgedoc Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-2331 Summary ======= The package hedgedoc before version 1.9.0-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.9.0-1. # pacman -Syu "hedgedoc>=1.9.0-1" The problem has been fixed upstream in version 1.9.0. Workaround ========== None. Description =========== In HedgeDoc versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-notes of the slide-mode feature by embedding an iframe hosting the malicious code into the slides or by embedding the HedgeDoc instance into another page. Impact ====== An unauthenticated remote attacker could execute arbitrary JavaScript code in the slide mode of HedgeDoc. References ========== https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-j748-779h-9697 https://github.com/hedgedoc/hedgedoc/pull/1369 https://github.com/hedgedoc/hedgedoc/pull/1375 https://github.com/hedgedoc/hedgedoc/pull/1513 https://security.archlinux.org/CVE-2021-39175

1 0

[ASA-202108-14] firefox: multiple issues
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-14 ========================================== Severity: High Date : 2021-08-11 CVE-ID : CVE-2021-29980 CVE-2021-29981 CVE-2021-29982 CVE-2021-29984 CVE-2021-29985 CVE-2021-29986 CVE-2021-29987 CVE-2021-29988 CVE-2021-29989 CVE-2021-29990 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2269 Summary ======= The package firefox before version 91.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and information disclosure. Resolution ========== Upgrade to 91.0-1. # pacman -Syu "firefox>=91.0-1" The problems have been fixed upstream in version 91.0. Workaround ========== None. Description =========== - CVE-2021-29980 (arbitrary code execution) A security issue has been found in Firefox before version 91 and Thunderbird before version 78.13. Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. - CVE-2021-29981 (arbitrary code execution) A security issue has been found in Firefox and Thunderbird before version 91. An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that would lead to a potentially exploitable crash. - CVE-2021-29982 (information disclosure) A security issue has been found in Firefox and Thunderbird before version 91. Due to incorrect JIT optimization, it incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a single bit of memory. - CVE-2021-29984 (arbitrary code execution) A security issue has been found in Firefox before version 91 and Thunderbird before version 78.13. Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection. This led to memory corruption and a potentially exploitable crash. - CVE-2021-29985 (arbitrary code execution) A security issue has been found in Firefox before version 91 and Thunderbird before version 78.13. A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. - CVE-2021-29986 (arbitrary code execution) A security issue has been found in Firefox before version 91 and Thunderbird before version 78.13. A suspected race condition when calling getaddrinfo() led to memory corruption and a potentially exploitable crash. - CVE-2021-29987 (content spoofing) A security issue has been found in Firefox and Thunderbird before version 91. After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default location, making it possible to trick a user into accepting a permission they did not want to. - CVE-2021-29988 (arbitrary code execution) Firefox before version 91 and Thunderbird before version 78.13 incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash. - CVE-2021-29989 (arbitrary code execution) Mozilla developers reported memory safety bugs present in Firefox 90 and Thunderbird 78.12. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2021-29990 (arbitrary code execution) Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker could execute arbitrary code or trick the user into accepting additional site permissions through maliciously crafted web content. References ========== https://www.mozilla.org/security/advisories/mfsa2021-33/ https://www.mozilla.org/security/advisories/mfsa2021-35/ https://bugzilla.mozilla.org/show_bug.cgi?id=1722204 https://www.mozilla.org/security/advisories/mfsa2021-36/ https://bugzilla.mozilla.org/show_bug.cgi?id=1707774 https://bugzilla.mozilla.org/show_bug.cgi?id=1715318 https://bugzilla.mozilla.org/show_bug.cgi?id=1720031 https://bugzilla.mozilla.org/show_bug.cgi?id=1722083 https://bugzilla.mozilla.org/show_bug.cgi?id=1696138 https://bugzilla.mozilla.org/show_bug.cgi?id=1716129 https://bugzilla.mozilla.org/show_bug.cgi?id=1717922 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662676%2C1666184%2C1719178… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1544190%2C1716481%2C1717778… https://security.archlinux.org/CVE-2021-29980 https://security.archlinux.org/CVE-2021-29981 https://security.archlinux.org/CVE-2021-29982 https://security.archlinux.org/CVE-2021-29984 https://security.archlinux.org/CVE-2021-29985 https://security.archlinux.org/CVE-2021-29986 https://security.archlinux.org/CVE-2021-29987 https://security.archlinux.org/CVE-2021-29988 https://security.archlinux.org/CVE-2021-29989 https://security.archlinux.org/CVE-2021-29990

1 0