Multiple vulnerabilities in Mozilla Firefox

1) Out-of-bounds read

EUVDB-ID: #VU53706

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-29964

CWE-ID:

Exploit availability:

Description

The vulnerability allows a local application to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A locally-installed hostile program could send WM_COPYDATA messages that Firefox would processing incorrectly and will result in out-of-bounds read.

Note, the vulnerability affects Windows installations only.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 60.0 - 88.0.1

Firefox ESR: 60.0 - 78.10.1

Fixed software versions

CPE2.3

• cpe:2.3:a:mozilla:mozilla_firefox:88.0.1:*:*:*:*:*:*:*

External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-24/
http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

2) Buffer overflow

EUVDB-ID: #VU53707

Risk: High

CVSSv3.1:

CVE-ID: CVE-2021-29967

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 60.0 - 88.0.1

Firefox ESR: 60.0 - 78.10.1

Fixed software versions

CPE2.3

• cpe:2.3:a:mozilla:mozilla_firefox:88.0.1:*:*:*:*:*:*:*

External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-24/
http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

3) Buffer overflow

EUVDB-ID: #VU53708

Risk: High

CVSSv3.1:

CVE-ID: CVE-2021-29966

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 80.0 - 88.0.1

Fixed software versions

CPE2.3

• cpe:2.3:a:mozilla:mozilla_firefox:88.0.1:*:*:*:*:*:*:*

External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

4) Spoofing attack

EUVDB-ID: #VU53709

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-29965

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data. A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Firefox for Android: 80.1.2 - 88.1.4

Fixed software versions

CPE2.3

• cpe:2.3:a:mozilla:firefox_for_android:88.1.4:*:*:*:*:*:*:*

External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

5) Information disclosure

EUVDB-ID: #VU53710

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-29960

CWE-ID:

Exploit availability:

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to the way firefox uses cache for the last filename used for printing a file. Firefox usually suggests the web page title. The caching and suggestion techniques combined may have lead to the title of a website visited during private browsing mode being stored on disk.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 80.0 - 88.0.1

Fixed software versions

CPE2.3

• cpe:2.3:a:mozilla:mozilla_firefox:88.0.1:*:*:*:*:*:*:*

External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

6) Spoofing attack

EUVDB-ID: #VU53711

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-29961

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect rendering an oversized <select> element. A remote attacker can spoof page content.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 80.0 - 88.0.1

Fixed software versions

CPE2.3

• cpe:2.3:a:mozilla:mozilla_firefox:88.0.1:*:*:*:*:*:*:*

External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

7) Information disclosure

EUVDB-ID: #VU53712

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-29963

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to address bar search suggestions in private browsing mode is re-using session data from normal mode. A remote website can identify the user using the suggested session data.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Firefox for Android: 80.1.2 - 88.1.4

Fixed software versions

CPE2.3

• cpe:2.3:a:mozilla:firefox_for_android:88.1.4:*:*:*:*:*:*:*

External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

8) Security restrictions bypass

EUVDB-ID: #VU53713

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-29959

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to the way user is prompted to access microphone and camera by the website. When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from re-enabling it without an additional prompt. This was only possible if the website kept recording with the microphone until re-enabling the camera.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 80.0 - 88.0.1

Fixed software versions

CPE2.3

• cpe:2.3:a:mozilla:mozilla_firefox:88.0.1:*:*:*:*:*:*:*

External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

9) Resource management error

EUVDB-ID: #VU53714

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-29962

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when processing multiple popups. A remote attacker can create a specially crafted webpage that opens multiple popups, which would make the Firefox for Android become unstable and hard-to-recover.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Firefox for Android: 80.1.2 - 88.1.4

Fixed software versions

CPE2.3

• cpe:2.3:a:mozilla:firefox_for_android:88.1.4:*:*:*:*:*:*:*

External links

http://www.mozilla.org/en-US/security/advisories/mfsa2021-23/

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?