Ubuntu update for firefox

1) Information disclosure

EUVDB-ID: #VU50021

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-23953

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to cross-origin information leak when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it and gain access to sensitive information via redirected PDF requests, when said information is served as chunked data.

Mitigation

Update the affected package firefox to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.10

firefox (Ubuntu package): before 85.0+build1-0ubuntu0.20.10.1

CPE2.3

External links

http://ubuntu.com/security/notices/USN-4717-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Type Confusion

EUVDB-ID: #VU50022

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-23954

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error when using the new logical assignment operators in a JavaScript switch statement. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package firefox to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.10

firefox (Ubuntu package): before 85.0+build1-0ubuntu0.20.10.1

CPE2.3

External links

http://ubuntu.com/security/notices/USN-4717-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Spoofing attack

EUVDB-ID: #VU50023

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-23955

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform clickjacking attack.

The vulnerability exists due to misusing requestPointerLock. The browser could have been confused into transferring a pointer lock state into another tab. A remote attacker can perform a clickjacking attack.

Mitigation

Update the affected package firefox to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.10

firefox (Ubuntu package): before 85.0+build1-0ubuntu0.20.10.1

CPE2.3

External links

http://ubuntu.com/security/notices/USN-4717-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Spoofing attack

EUVDB-ID: #VU50026

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-23956

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to confusing behavior of the file picker dialog. A remote attacker can trick the victim who intended to select and upload a single file into uploading a whole directory.

Mitigation

Update the affected package firefox to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.10

firefox (Ubuntu package): before 85.0+build1-0ubuntu0.20.10.1

CPE2.3

External links

http://ubuntu.com/security/notices/USN-4717-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource management error

EUVDB-ID: #VU50028

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-23958

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper management of internal resources within the application. A remote attacker can confuse the browser into transferring a screen sharing state into another tab, which would leak unintended information.

Mitigation

Update the affected package firefox to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.10

firefox (Ubuntu package): before 85.0+build1-0ubuntu0.20.10.1

CPE2.3

External links

http://ubuntu.com/security/notices/USN-4717-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU50024

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-23960

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input when performing garbage collection on re-declared JavaScript variables. A remote attacker can create a specially crafted web page, trick the victim into opening it and execute arbitrary code on the system.

Mitigation

Update the affected package firefox to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.10

firefox (Ubuntu package): before 85.0+build1-0ubuntu0.20.10.1

CPE2.3

External links

http://ubuntu.com/security/notices/USN-4717-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Information disclosure

EUVDB-ID: #VU50030

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-23961

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the way Firefox handles requests to internal resources. A remote attacker can create a specially crafted web page and combined with slipstream research techniques collect information about hosts in internal network as well as services running on the user's local machine.

Mitigation

Update the affected package firefox to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.10

firefox (Ubuntu package): before 85.0+build1-0ubuntu0.20.10.1

CPE2.3

External links

http://ubuntu.com/security/notices/USN-4717-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Buffer overflow

EUVDB-ID: #VU50031

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-23962

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content in nsTreeBodyFrame::RowCountChanged. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption, which results in a user-after-poison and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package firefox to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.10

firefox (Ubuntu package): before 85.0+build1-0ubuntu0.20.10.1

CPE2.3

External links

http://ubuntu.com/security/notices/USN-4717-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Resource management error

EUVDB-ID: #VU50032

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-23963

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application. When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission.

Mitigation

Update the affected package firefox to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.10

firefox (Ubuntu package): before 85.0+build1-0ubuntu0.20.10.1

CPE2.3

External links

http://ubuntu.com/security/notices/USN-4717-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Buffer overflow

EUVDB-ID: #VU50025

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-23964

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package firefox to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.10

firefox (Ubuntu package): before 85.0+build1-0ubuntu0.20.10.1

CPE2.3

External links

http://ubuntu.com/security/notices/USN-4717-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Buffer overflow

EUVDB-ID: #VU50033

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-23965

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package firefox to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 20.10

firefox (Ubuntu package): before 85.0+build1-0ubuntu0.20.10.1

CPE2.3

External links

http://ubuntu.com/security/notices/USN-4717-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	11
CVE-ID	CVE-2021-23953 CVE-2021-23954 CVE-2021-23955 CVE-2021-23956 CVE-2021-23958 CVE-2021-23960 CVE-2021-23961 CVE-2021-23962 CVE-2021-23963 CVE-2021-23964 CVE-2021-23965
CWE-ID	CWE-200 CWE-843 CWE-451 CWE-399 CWE-119
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Ubuntu Operating systems & Components / Operating system firefox (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.