Red Hat Security Advisory: firefox security update

Fixed packages 6

Vulnerabilities 10

• Critical 9.8
  CVE-2021-4129

  Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• Unscored —
  CVE-2021-43536

  Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. T…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021
• Unscored —
  CVE-2021-43537

  An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a p…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021
• Unscored —
  CVE-2021-43538

  By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that h…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021
• Unscored —
  CVE-2021-43539

  Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021
• Unscored —
  CVE-2021-43541

  When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly esc…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021
• Unscored —
  CVE-2021-43542

  Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading ex…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021
• Unscored —
  CVE-2021-43543

  Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additi…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021
• Unscored —
  CVE-2021-43545

  Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thu…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021
• Unscored —
  CVE-2021-43546

  It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerabil…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 8, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2030105
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2030106
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2030109
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2030110
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2030111
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2030112
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2030113
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2030114
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2030115
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2030116
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5014.json
• report
  https://access.redhat.com/security/cve/CVE-2021-4129
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-4129
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-4129
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2021-53/#CVE-2021-4129
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2021-54/#CVE-2021-4129
• report
  https://access.redhat.com/security/cve/CVE-2021-43536
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-43536
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-43536
• report
  https://access.redhat.com/security/cve/CVE-2021-43537
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-43537
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-43537
• report
  https://access.redhat.com/security/cve/CVE-2021-43538
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-43538
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-43538
• report
  https://access.redhat.com/security/cve/CVE-2021-43539
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-43539
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-43539
• report
  https://access.redhat.com/security/cve/CVE-2021-43541
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-43541
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-43541
• report
  https://access.redhat.com/security/cve/CVE-2021-43542
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-43542
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-43542
• report
  https://access.redhat.com/security/cve/CVE-2021-43543
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-43543
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-43543
• report
  https://access.redhat.com/security/cve/CVE-2021-43545