ALT-PU-2021-1162-1
Closed vulnerabilities
BDU:2021-02079
Уязвимость браузера Mozilla Firefox, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код
BDU:2021-02080
Уязвимость расширения WebRTC браузера Mozilla Firefox, позволяющая нарушителю оказать воздействие на целостность данных
BDU:2021-02081
Уязвимость метода <RowCountChanged> браузера Mozilla Firefox, позволяющая нарушителю повысить свои привилегии или вызвать отказ в обслуживании
BDU:2021-02082
Уязвимость браузера Mozilla Firefox, связанная с раскрытием информации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2021-02083
Уязвимость браузера Mozilla Firefox, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю осуществлять межсайтовые сценарные атаки
BDU:2021-02084
Уязвимость браузера Mozilla Firefox, связанная с ошибками управления ресурсами, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2021-02085
Уязвимость изолированной среды iframe браузера Firefox for Android, позволяющая нарушителю оказать воздействие на целостность данных
BDU:2021-02086
Уязвимость браузера Mozilla Firefox, связанная с ошибками представления информации пользовательским интерфейсом, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2021-02087
Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с ошибкой преобразования типов, позволяющая нарушителю выполнить произвольный код
BDU:2021-02088
Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код
BDU:2021-02089
Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с включением функций из недостоверной контролируемой области, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2021-02090
Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с некорректной обработкой нулевых байтов или символов NULL при обмене данными, позволяющая нарушителю повысить свои привилегии или вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2021-23953
If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1683940
- https://bugzilla.mozilla.org/show_bug.cgi?id=1683940
- https://www.mozilla.org/security/advisories/mfsa2021-03/
- https://www.mozilla.org/security/advisories/mfsa2021-03/
- https://www.mozilla.org/security/advisories/mfsa2021-04/
- https://www.mozilla.org/security/advisories/mfsa2021-04/
- https://www.mozilla.org/security/advisories/mfsa2021-05/
- https://www.mozilla.org/security/advisories/mfsa2021-05/
Modified: 2024-11-21
CVE-2021-23954
Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1684020
- https://bugzilla.mozilla.org/show_bug.cgi?id=1684020
- https://www.mozilla.org/security/advisories/mfsa2021-03/
- https://www.mozilla.org/security/advisories/mfsa2021-03/
- https://www.mozilla.org/security/advisories/mfsa2021-04/
- https://www.mozilla.org/security/advisories/mfsa2021-04/
- https://www.mozilla.org/security/advisories/mfsa2021-05/
- https://www.mozilla.org/security/advisories/mfsa2021-05/
Modified: 2024-11-21
CVE-2021-23955
The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks. This vulnerability affects Firefox < 85.
Modified: 2024-11-21
CVE-2021-23956
An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. This was addressed by adding a new prompt. This vulnerability affects Firefox < 85.
Modified: 2024-11-21
CVE-2021-23957
Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 85.
Modified: 2024-11-21
CVE-2021-23958
The browser could have been confused into transferring a screen sharing state into another tab, which would leak unintended information. This vulnerability affects Firefox < 85.
Modified: 2024-11-21
CVE-2021-23959
An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 85.
Modified: 2024-11-21
CVE-2021-23960
Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1675755
- https://bugzilla.mozilla.org/show_bug.cgi?id=1675755
- https://www.mozilla.org/security/advisories/mfsa2021-03/
- https://www.mozilla.org/security/advisories/mfsa2021-03/
- https://www.mozilla.org/security/advisories/mfsa2021-04/
- https://www.mozilla.org/security/advisories/mfsa2021-04/
- https://www.mozilla.org/security/advisories/mfsa2021-05/
- https://www.mozilla.org/security/advisories/mfsa2021-05/
Modified: 2024-11-21
CVE-2021-23961
Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox < 85.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1677940
- https://bugzilla.mozilla.org/show_bug.cgi?id=1677940
- [debian-lts-announce] 20210422 [SECURITY] [DLA 2632-1] thunderbird security update
- [debian-lts-announce] 20210422 [SECURITY] [DLA 2632-1] thunderbird security update
- [debian-lts-announce] 20210423 [SECURITY] [DLA 2633-1] firefox-esr security update
- [debian-lts-announce] 20210423 [SECURITY] [DLA 2633-1] firefox-esr security update
- GLSA-202104-09
- GLSA-202104-09
- GLSA-202104-10
- GLSA-202104-10
- DSA-4895
- DSA-4895
- DSA-4897
- DSA-4897
- https://www.mozilla.org/security/advisories/mfsa2021-03/
- https://www.mozilla.org/security/advisories/mfsa2021-03/
Modified: 2024-11-21
CVE-2021-23962
Incorrect use of the '
Modified: 2024-11-21
CVE-2021-23963
When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission. This vulnerability affects Firefox < 85.
Modified: 2024-11-21
CVE-2021-23964
Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662507%2C1666285%2C1673526%2C1674278%2C1674835%2C1675097%2C1675844%2C1675868%2C1677590%2C1677888%2C1680410%2C1681268%2C1682068%2C1682938%2C1683736%2C1685260%2C1685925
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662507%2C1666285%2C1673526%2C1674278%2C1674835%2C1675097%2C1675844%2C1675868%2C1677590%2C1677888%2C1680410%2C1681268%2C1682068%2C1682938%2C1683736%2C1685260%2C1685925
- https://www.mozilla.org/security/advisories/mfsa2021-03/
- https://www.mozilla.org/security/advisories/mfsa2021-03/
- https://www.mozilla.org/security/advisories/mfsa2021-04/
- https://www.mozilla.org/security/advisories/mfsa2021-04/
- https://www.mozilla.org/security/advisories/mfsa2021-05/
- https://www.mozilla.org/security/advisories/mfsa2021-05/
Modified: 2024-11-21
CVE-2021-23965
Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85.
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1670378%2C1673555%2C1676812%2C1678582%2C1684497
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1670378%2C1673555%2C1676812%2C1678582%2C1684497
- https://www.mozilla.org/security/advisories/mfsa2021-03/
- https://www.mozilla.org/security/advisories/mfsa2021-03/