SB2021060847 - SUSE update for MozillaFirefox 



SB2021060847 - SUSE update for MozillaFirefox

Published: June 8, 2021

Security Bulletin ID SB2021060847
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Security restrictions bypass (CVE-ID: CVE-2021-29951)

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to the way Mozilla Maintenance Service is installed in the Windows operating system. After installation the Mozilla Maintenance Service is granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop the service. A local domain user can spam  the "Stop" command and prevent the browser update service from operating.

The vulnerability affects only Firefox ESR installed on operating system Windows 10 build 1709 and older.


2) Out-of-bounds read (CVE-ID: CVE-2021-29964)

The vulnerability allows a local application to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A locally-installed hostile program could send WM_COPYDATA messages that Firefox would processing incorrectly and will result in out-of-bounds read.

Note, the vulnerability affects Windows installations only.


3) Buffer overflow (CVE-ID: CVE-2021-29967)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install update from vendor's website.