Summary
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information, conduct cross-site scripting (XSS) attacks, bypass HTTP auth
phishing warnings, or execute arbitrary code.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | firefox | 86.0+build3-0ubuntu0.16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 86.0+build3-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | firefox | 86.0+build3-0ubuntu0.20.04.1 |
Vulnerabilities 10
-
Unscored —
If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reporte…
-
Unscored —
As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure th…
-
Unscored —
Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded was…
-
Unscored —
When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's Referrer-Polic…
-
Unscored —
One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://www.phishingtarget.com@evil.co…
-
Unscored —
When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the conte…
-
Unscored —
The DOMParser API did not properly process '<noscript>' elements for escaping. This could be used as an mXSS vector to …
-
Unscored —
The developer page about:memory has a Measure function for exploring what object types the browser has allocated and th…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed ev…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed evidence of memory corr…
References
-
report
https://ubuntu.com/security/CVE-2021-23968
-
report
https://ubuntu.com/security/CVE-2021-23969
-
report
https://ubuntu.com/security/CVE-2021-23970
-
report
https://ubuntu.com/security/CVE-2021-23971
-
report
https://ubuntu.com/security/CVE-2021-23972
-
report
https://ubuntu.com/security/CVE-2021-23973
-
report
https://ubuntu.com/security/CVE-2021-23974
-
report
https://ubuntu.com/security/CVE-2021-23975
-
report
https://ubuntu.com/security/CVE-2021-23978
-
report
https://ubuntu.com/security/CVE-2021-23979