Rewterz Threat Advisory –Multiple Mozilla Firefox Security Vulnerabilities

Severity

High

Analysis Summary

CVE-2021-29990

Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.

CVE-2021-29982

Mozilla Firefox could allow a remote attacker to obtain sensitive information, caused by incorrect JIT optimization and type confusion. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to leak single bit data.

CVE-2021-29985

Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in MediaCacheStream::NotifyDataReceived method. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service

CVE-2021-29987

Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by the displaying of permission panels after requesting multiple permissions, and closing the first permission panel. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to trick the user into accepting unwanted permissions on Linux.

CVE-2021-29980

Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by uninitialized memory in a canvas object. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.

CVE-2021-29984

Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by incorrect instruction reordering during JIT optimization. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.

CVE-2021-29983

Mozilla Firefox for Android could allow a remote attacker to bypass security restrictions, caused by getting stuck in fullscreen mode and the failure to exit after normal interactions. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions.

CVE-2021-29988

Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by incorrect style treatment that triggers an out-of-bounds read. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.

CVE-2021-29981

Mozilla Firefox is vulnerable to a denial of service, caused by live range splitting in lowering/register allocation that leads to conflicting assignments in the JIT. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to cause the browser to crash.

CVE-2021-29986

Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a race condition when calling getaddrinfo. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.

CVE-2021-29989

Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.

Impact

• Code Execution
• Denial of Service
• Bypass Security
• Unauthorized Access

Affected Vendors

• Mozilla

Affected Products

• Mozilla Firefox 90
• Mozilla Firefox ESR 78.12
• Mozilla Firefox for Android 90
• Mozilla Thunderbird 78.12

Remediation

Refer to Mozilla Foundation Security Advisory 2021-33 for patch, upgrade or suggested workaround information.

https://www.mozilla.org/en-US/security/advisories/