Summary
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information, or execute arbitrary code. (CVE-2021-23981, CVE-2021-23982,
CVE-2021-23983, CVE-2021-23987, CVE-2021-23988)
It was discovered that extensions could open popup windows with control
of the window title in some circumstances. If a user were tricked into
installing a specially crafted extension, an attacker could potentially
exploit this to spook a website and trick the user into providing
credentials. (CVE-2021-23984)
It was discovered that the DevTools remote debugging feature could be
enabled without an indication to the user. If a local attacker could
modify the browser configuration, a remote attacker could potentially
exploit this to obtain sensitive information. (CVE-2021-23985)
It was discovered that extensions could read the response of cross
origin requests in some circumstances. If a user were tricked into
installing a specially crafted extension, an attacker could potentially
exploit this to obtain sensitive information. (CVE-2021-23986)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | firefox | 87.0+build3-0ubuntu0.16.04.2 |
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 87.0+build3-0ubuntu0.18.04.2 |
| Ubuntu · 20.04 LTS 20.04:LTS | firefox | 87.0+build3-0ubuntu0.20.04.2 |
Vulnerabilities 8
-
Unscored —
A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack …
-
Unscored —
Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network…
-
Unscored —
By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been appli…
-
Unscored —
A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an addres…
-
Unscored —
If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the …
-
Unscored —
A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a …
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some o…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corr…
References
-
report
https://ubuntu.com/security/CVE-2021-23981
-
report
https://ubuntu.com/security/CVE-2021-23982
-
report
https://ubuntu.com/security/CVE-2021-23983
-
report
https://ubuntu.com/security/CVE-2021-23984
-
report
https://ubuntu.com/security/CVE-2021-23985
-
report
https://ubuntu.com/security/CVE-2021-23986
-
report
https://ubuntu.com/security/CVE-2021-23987
-
report
https://ubuntu.com/security/CVE-2021-23988