Risk | High |
Patch available | YES |
Number of vulnerabilities | 20 |
CVE-ID | CVE-2021-29980 CVE-2021-29981 CVE-2021-29982 CVE-2021-29983 CVE-2021-29984 CVE-2021-29985 CVE-2021-29986 CVE-2021-29987 CVE-2021-29988 CVE-2021-29989 CVE-2021-29990 CVE-2021-29991 CVE-2021-32810 CVE-2021-38492 CVE-2021-38495 CVE-2021-38496 CVE-2021-38497 CVE-2021-38498 CVE-2021-38500 CVE-2021-38501 |
CWE-ID | CWE-119 CWE-20 CWE-843 CWE-399 CWE-416 CWE-357 CWE-125 CWE-113 CWE-362 CWE-346 |
Exploitation vector | Network |
Public exploit | Public exploit code for vulnerability #6 is available. |
Vulnerable software Subscribe |
SUSE Linux Enterprise Module for Desktop Applications Operating systems & Components / Operating system MozillaFirefox-devel Operating systems & Components / Operating system package or component MozillaFirefox-translations-other Operating systems & Components / Operating system package or component MozillaFirefox-translations-common Operating systems & Components / Operating system package or component MozillaFirefox-debugsource Operating systems & Components / Operating system package or component MozillaFirefox-debuginfo Operating systems & Components / Operating system package or component MozillaFirefox-branding-SLE Operating systems & Components / Operating system package or component MozillaFirefox Operating systems & Components / Operating system package or component |
Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 20 vulnerabilities.
EUVDB-ID: #VU55683
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-29980
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in a canvas object. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU55679
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-29981
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input when lowering/register allocation during live range splitting. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger register confusion failures in JITted code and execute arbitrary code on the system.
Update the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU55687
Risk: Low
CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-29982
CWE-ID:
CWE-843 - Type confusion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to incorrect JIT optimization and a type confusion error. A remote attacker can trick the victim to open a specially crafted web page and read a single bit of memory.
MitigationUpdate the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU55681
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-29983
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform clickjacking attack.
The vulnerability exists due to improper management of internal resources within the application. Firefox for Android can get stuck in fullscreen mode and not exit it
even after normal interactions that should cause it to exit. A remote attacker can abuse this to trick the victim into revealing sensitive information.
Update the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU55682
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-29984
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when performing JIT optimization. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU55684
Risk: High
CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2021-29985
CWE-ID:
CWE-416 - Use After Free
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a use-after-free error in media channels within the MediaCacheStream::NotifyDataReceived method. A remote attacker can trick the victim to open a specially crafted web page, trigger a use-after-free error and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
EUVDB-ID: #VU55678
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-29986
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a race condition in getaddrinfo
when resolving DNS names. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note, the vulnerability affects Linux systems only.
Update the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU55686
Risk: Low
CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-29987
CWE-ID:
CWE-357 - Insufficient UI Warning of Dangerous Operations
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to the way Firefox displays permission panels. After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default location, making it possible to trick a user into accepting a permission they did not want to.
Note, the vulnerability affects Linux installations only.
Update the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU55680
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-29988
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to a boundary condition when treating inline list-item element as a block element. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger an out-of-bounds read error and execute arbitrary code on the system.
Update the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU55685
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-29989
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU55688
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-29990
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU55935
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-29991
CWE-ID:
CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform HTTP splitting attacks.
The vulnerability exists due to the affected software incorrectly accepts a newline in a HTTP/3 header, interpretting it as two separate headers. A remote attacker can perform a header splitting attack against servers using HTTP/3.
MitigationUpdate the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU55598
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-32810
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a race condition in the "Stealer::steal", "Stealer::steal_batch" and "Stealer::steal_batch_and_pop" functions. A remote attacker can exploit the race and gain unauthorized access to sensitive information and execute arbitrary code on the system.
MitigationUpdate the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU56373
Risk: Medium
CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-38492
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of user-supplied input when delegating navigations to the operating system. Firefox accept the mk
scheme, which allows a remote attacker to launch pages and execute scripts in Internet Explorer in unprivileged mode.
Update the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU56376
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-38495
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU57064
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-38496
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error during operations on MessageTasks. A remote attacker can trick the victim to visit a specially crafted web page, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationUpdate the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU57066
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-38497
CWE-ID:
CWE-346 - Origin Validation Error
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an error, which can cause a plain-text validation message to overlaid on another origin through the use of reportValidity()
and window.open()
. A remote attacker can perform a spoofing attack.
Update the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU57067
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-38498
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the nsLanguageAtomService object. A remote attacker can trick the victim to open a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationUpdate the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU57065
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-38500
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can trick the victim to visit a specially crafted web page, trigger a memory corruption and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationUpdate the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU57068
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-38501
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package MozillaFirefox to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Desktop Applications: 15-SP2 - 15-SP3
MozillaFirefox-devel: before 91.2.0-8.54.1
MozillaFirefox-translations-other: before 91.2.0-8.54.1
MozillaFirefox-translations-common: before 91.2.0-8.54.1
MozillaFirefox-debugsource: before 91.2.0-8.54.1
MozillaFirefox-debuginfo: before 91.2.0-8.54.1
MozillaFirefox-branding-SLE: before 91-9.5.1
MozillaFirefox: before 91.2.0-8.54.1
CPE2.3http://www.suse.com/support/update/announcement/2021/suse-su-20213451-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.