ALT-BU-2021-3926-1
Branch c9f1 update bulletin.
Package firefox-esr updated to version 78.10.1-alt0.c9.1 for branch c9f1 in task 271263.
Closed vulnerabilities
BDU:2022-06101
Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с небезопасным управлением привилегиями, позволяющая нарушителю, действующему удаленно, повысить свои привилегии
Modified: 2024-11-21
CVE-2021-29951
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. This could be used to prevent the browser update service from operating (if an attacker spammed the 'Stop' command); but also exposed attack surface in the maintenance service. *Note: This issue only affected Windows operating systems older than Win 10 build 1709. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.10.1, Firefox < 87, and Firefox ESR < 78.10.1.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1690062
- https://bugzilla.mozilla.org/show_bug.cgi?id=1690062
- https://www.mozilla.org/security/advisories/mfsa2021-10/
- https://www.mozilla.org/security/advisories/mfsa2021-10/
- https://www.mozilla.org/security/advisories/mfsa2021-18/
- https://www.mozilla.org/security/advisories/mfsa2021-18/
- https://www.mozilla.org/security/advisories/mfsa2021-19/
- https://www.mozilla.org/security/advisories/mfsa2021-19/