Arch Linux Security Advisory ASA-202107-38

Severity: Medium
Date : 2021-07-20
CVE-ID : CVE-2021-36773
Package : firefox-ublock-origin
Type : denial of service
Remote : Yes
Link : https://security.archlinux.org/AVG-2172

Summary

The package firefox-ublock-origin before version 1.36.2-1 is vulnerable
to denial of service.

Resolution

Upgrade to 1.36.2-1.

pacman -Syu “firefox-ublock-origin>=1.36.2-1”

The problem has been fixed upstream in version 1.36.2.

Workaround

None.

Description

uBlock Origin before 1.36.2 supports an arbitrary depth of parameter
nesting for strict blocking, which allows crafted web sites to cause a
denial of service (unbounded recursion that can trigger memory
consumption and a loss of all blocking functionality).

Impact

A crafted web site could consume a lot of memory, disabling all
blocking functionality.

References

https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adoc
https://github.com/uBlockOrigin/uBlock-issues/issues/1649
https://github.com/gorhill/uBlock/commit/365b20e8cc27cd776ef3868b02ea739ba387356d
https://security.archlinux.org/CVE-2021-36773