Multiple vulnerabilities in Mozilla Firefox



Published: 2021-06-01
Risk High
Patch available YES
Number of vulnerabilities 9
CVE-ID CVE-2021-29964
CVE-2021-29967
CVE-2021-29966
CVE-2021-29965
CVE-2021-29960
CVE-2021-29961
CVE-2021-29963
CVE-2021-29959
CVE-2021-29962
CWE-ID CWE-125
CWE-119
CWE-451
CWE-200
CWE-264
CWE-399
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Mozilla Firefox
Client/Desktop applications / Web browsers

Firefox ESR
Client/Desktop applications / Web browsers

Firefox for Android
Mobile applications / Apps for mobile phones

Vendor Mozilla

Security Bulletin

This security bulletin contains information about 9 vulnerabilities.

1) Out-of-bounds read

EUVDB-ID: #VU53706

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-29964

CWE-ID: CWE-125 - Out-of-bounds Read

Exploit availability: No

Description

The vulnerability allows a local application to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A locally-installed hostile program could send WM_COPYDATA messages that Firefox would processing incorrectly and will result in out-of-bounds read.

Note, the vulnerability affects Windows installations only.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 60.0 - 88.0.1

Firefox ESR: 78.0 - 78.10.1, 68.0 - 68.12.0, 60.0 - 60.9.0


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-24/
http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

2) Buffer overflow

EUVDB-ID: #VU53707

Risk: High

CVSSv3.1:

CVE-ID: CVE-2021-29967

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 60.0 - 88.0.1

Firefox ESR: 78.0 - 78.10.1, 68.0 - 68.12.0, 60.0 - 60.9.0


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-24/
http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

3) Buffer overflow

EUVDB-ID: #VU53708

Risk: High

CVSSv3.1:

CVE-ID: CVE-2021-29966

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 80.0 - 88.0.1


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

4) Spoofing attack

EUVDB-ID: #VU53709

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-29965

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data. A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Firefox for Android: 80.1.2 - 88.1.4


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

5) Information disclosure

EUVDB-ID: #VU53710

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-29960

CWE-ID: CWE-200 - Information Exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to the way firefox uses cache for the last filename used for printing a file. Firefox usually suggests the web page title. The caching and suggestion techniques combined may have lead to the title of a website visited during private browsing mode being stored on disk.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 80.0 - 88.0.1


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

6) Spoofing attack

EUVDB-ID: #VU53711

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-29961

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect rendering an oversized <select> element. A remote attacker can spoof page content.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 80.0 - 88.0.1


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

7) Information disclosure

EUVDB-ID: #VU53712

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-29963

CWE-ID: CWE-200 - Information Exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to address bar search suggestions in private browsing mode is re-using session data from normal mode. A remote website can identify the user using the suggested session data.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Firefox for Android: 80.1.2 - 88.1.4


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

8) Security restrictions bypass

EUVDB-ID: #VU53713

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-29959

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to the way user is prompted to access microphone and camera by the website. When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from re-enabling it without an additional prompt. This was only possible if the website kept recording with the microphone until re-enabling the camera.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 80.0 - 88.0.1


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

9) Resource management error

EUVDB-ID: #VU53714

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-29962

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when processing multiple popups. A remote attacker can create a specially crafted webpage that opens multiple popups, which would make the Firefox for Android become unstable and hard-to-recover.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Firefox for Android: 80.1.2 - 88.1.4


CPE2.3 External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###