KLA12252 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, spoof user interface, execute arbitrary code, obtain sensitive information, gain privileges.

Below is a complete list of vulnerabilities:

1. A memory corruption vulnerability on Linux can be exploited to cause denial of service.
2. A security UI vulnerability in fullscreen mode on Android can be exploited to spoof user interface.
3. A memory corruption vulnerability can be exploited to cause denial of service.
4. A memory safety vulnerability can be exploited to execute arbitrary code.
5. A denial of service vulnerability in JIT can be exploited to cause denial of service.
6. A use after free vulnerability in media channels can be exploited to cause denial of service.
7. A type confusion vulnerability in JIT optimization can be exploited to obtain sensitive information.
8. A security UI vulnerability on Linux can be exploited to spoof user interface and gain privileges.
9. A uninitialized memory vulnerability in canvas can be epxloted to cause denial of service.
10. A memory corruption vulnerability in JIT optimization can be exploited to cause denial of service.

Original advisories

MFSA2021-33

Related products

Mozilla-Firefox

CVE list

CVE-2021-29986 unknown

CVE-2021-29983 unknown

CVE-2021-29988 unknown

CVE-2021-29989 unknown

CVE-2021-29981 unknown

CVE-2021-29985 unknown

CVE-2021-29982 unknown

CVE-2021-29987 unknown

CVE-2021-29980 unknown

CVE-2021-29990 unknown

CVE-2021-29984 unknown

Solution

Update to the latest version

Download Firefox

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Mozilla Firefox earlier than 91