[ASA-202109-2] firefox: multiple issues
diabonas at archlinux.org
Wed Sep 15 08:48:07 UTC 2021
Arch Linux Security Advisory ASA-202109-2
Date : 2021-09-14
CVE-ID : CVE-2021-38491 CVE-2021-38494
Package : firefox
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-2350
The package firefox before version 92.0-1 is vulnerable to multiple
issues including arbitrary code execution and insufficient validation.
Upgrade to 92.0-1.
# pacman -Syu "firefox>=92.0-1"
The problems have been fixed upstream in version 92.0.
- CVE-2021-38491 (insufficient validation)
In Firefox before version 92, mixed-content checks were unable to
analyze opaque origins which led to some mixed content being loaded.
- CVE-2021-38494 (arbitrary code execution)
Mozilla developers reported memory safety bugs present in Firefox 91.
Some of these bugs showed evidence of memory corruption and Mozilla
presumes that with enough effort some of these could have been
exploited to run arbitrary code.
A remote attacker could execute arbitrary code through crafted web
content, or load content over HTTP on a web page otherwise served
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security