Summary
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, spoof the
browser UI, bypass security restrictions, trick the user into disclosing
confidential information, or execute arbitrary code. (CVE-2021-23994,
CVE-2021-23996, CVE-2021-23997, CVE-2021-23998, CVE-2021-23999,
CVE-2021-24000, CVE-2021-24001, CVE-2021-29945, CVE-2021-29946,
CVE-2021-29947)
A use-after-free was discovered when Responsive Design Mode was
enabled. If a user were tricked into opening a specially crafted
website with Responsive Design Mode enabled, an attacker could
potentially exploit this to cause a denial of service, or execute
arbitrary code. (CVE-2021-23995)
It was discovered that Firefox mishandled ftp URLs with encoded newline
characters. If a user were tricked into clicking on a specially crafted
link, an attacker could potentially exploit this to send arbitrary
FTP commands. (CVE-2021-24002)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | firefox | 88.0+build2-0ubuntu0.16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 88.0+build2-0ubuntu0.18.04.2 |
| Ubuntu · 20.04 LTS 20.04:LTS | firefox | 88.0+build2-0ubuntu0.20.04.1 |
Vulnerabilities 12
-
Unscored —
A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vu…
-
Unscored —
When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with…
-
Unscored —
By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, re…
-
Unscored —
Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We …
-
Unscored —
Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS pa…
-
Unscored —
If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and g…
-
Unscored —
A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when…
-
Unscored —
A compromised content process could have performed session history manipulations it should not have been able to due to…
-
Unscored —
When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been int…
-
Unscored —
The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash…
-
Unscored —
Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking r…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 87. Some of these bugs showed e…
References
-
report
https://ubuntu.com/security/CVE-2021-23994
-
report
https://ubuntu.com/security/CVE-2021-23995
-
report
https://ubuntu.com/security/CVE-2021-23996
-
report
https://ubuntu.com/security/CVE-2021-23997
-
report
https://ubuntu.com/security/CVE-2021-23998
-
report
https://ubuntu.com/security/CVE-2021-23999
-
report
https://ubuntu.com/security/CVE-2021-24000
-
report
https://ubuntu.com/security/CVE-2021-24001
-
report
https://ubuntu.com/security/CVE-2021-24002
-
report
https://ubuntu.com/security/CVE-2021-29945
-
report
https://ubuntu.com/security/CVE-2021-29946
-
report
https://ubuntu.com/security/CVE-2021-29947