Arch Linux Security Advisory ASA-202108-14 ========================================== Severity: High Date : 2021-08-11 CVE-ID : CVE-2021-29980 CVE-2021-29981 CVE-2021-29982 CVE-2021-29984 CVE-2021-29985 CVE-2021-29986 CVE-2021-29987 CVE-2021-29988 CVE-2021-29989 CVE-2021-29990 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2269 Summary ======= The package firefox before version 91.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and information disclosure. Resolution ========== Upgrade to 91.0-1. # pacman -Syu "firefox>=91.0-1" The problems have been fixed upstream in version 91.0. Workaround ========== None. Description =========== - CVE-2021-29980 (arbitrary code execution) A security issue has been found in Firefox before version 91 and Thunderbird before version 78.13. Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. - CVE-2021-29981 (arbitrary code execution) A security issue has been found in Firefox and Thunderbird before version 91. An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that would lead to a potentially exploitable crash. - CVE-2021-29982 (information disclosure) A security issue has been found in Firefox and Thunderbird before version 91. Due to incorrect JIT optimization, it incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a single bit of memory. - CVE-2021-29984 (arbitrary code execution) A security issue has been found in Firefox before version 91 and Thunderbird before version 78.13. Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection. This led to memory corruption and a potentially exploitable crash. - CVE-2021-29985 (arbitrary code execution) A security issue has been found in Firefox before version 91 and Thunderbird before version 78.13. A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. - CVE-2021-29986 (arbitrary code execution) A security issue has been found in Firefox before version 91 and Thunderbird before version 78.13. A suspected race condition when calling getaddrinfo() led to memory corruption and a potentially exploitable crash. - CVE-2021-29987 (content spoofing) A security issue has been found in Firefox and Thunderbird before version 91. After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default location, making it possible to trick a user into accepting a permission they did not want to. - CVE-2021-29988 (arbitrary code execution) Firefox before version 91 and Thunderbird before version 78.13 incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash. - CVE-2021-29989 (arbitrary code execution) Mozilla developers reported memory safety bugs present in Firefox 90 and Thunderbird 78.12. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2021-29990 (arbitrary code execution) Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker could execute arbitrary code or trick the user into accepting additional site permissions through maliciously crafted web content. References ========== https://www.mozilla.org/security/advisories/mfsa2021-33/ https://www.mozilla.org/security/advisories/mfsa2021-35/ https://bugzilla.mozilla.org/show_bug.cgi?id=1722204 https://www.mozilla.org/security/advisories/mfsa2021-36/ https://bugzilla.mozilla.org/show_bug.cgi?id=1707774 https://bugzilla.mozilla.org/show_bug.cgi?id=1715318 https://bugzilla.mozilla.org/show_bug.cgi?id=1720031 https://bugzilla.mozilla.org/show_bug.cgi?id=1722083 https://bugzilla.mozilla.org/show_bug.cgi?id=1696138 https://bugzilla.mozilla.org/show_bug.cgi?id=1716129 https://bugzilla.mozilla.org/show_bug.cgi?id=1717922 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662676%2C1666184%2C1719178%... https://bugzilla.mozilla.org/buglist.cgi?bug_id=1544190%2C1716481%2C1717778%... https://security.archlinux.org/CVE-2021-29980 https://security.archlinux.org/CVE-2021-29981 https://security.archlinux.org/CVE-2021-29982 https://security.archlinux.org/CVE-2021-29984 https://security.archlinux.org/CVE-2021-29985 https://security.archlinux.org/CVE-2021-29986 https://security.archlinux.org/CVE-2021-29987 https://security.archlinux.org/CVE-2021-29988 https://security.archlinux.org/CVE-2021-29989 https://security.archlinux.org/CVE-2021-29990