CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
82.5%
Severity: High
Date : 2021-02-01
CVE-ID : CVE-2021-23953 CVE-2021-23954 CVE-2021-23955 CVE-2021-23956
CVE-2021-23958 CVE-2021-23960 CVE-2021-23961 CVE-2021-23962
CVE-2021-23963 CVE-2021-23964 CVE-2021-23965
Package : firefox
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1492
The package firefox before version 85.0-1 is vulnerable to multiple
issues including arbitrary code execution, incorrect calculation and
information disclosure.
Upgrade to 85.0-1.
The problems have been fixed upstream in version 85.0.
None.
A security issue was found in Firefox before version 85.0 and
Thunderbird before version 78.7. If a user clicked into a specifically
crafted PDF, the PDF reader could be confused into leaking cross-origin
information, when said information is served as chunked data.
A security issue was found in Firefox before version 85.0 and
Thunderbird before version 78.7. Using the new logical assignment
operators in a JavaScript switch statement could have caused a type
confusion, leading to a memory corruption and a potentially exploitable
crash.
A security issue was found in Firefox before version 85.0. The browser
could have been confused into transferring a pointer lock state into
another tab, which could have lead to clickjacking attacks.
A security issue was found in Firefox before version 85.0. An ambiguous
file picker design could have confused users who intended to select and
upload a single file into uploading a whole directory. This was
addressed by adding a new prompt.
A security issue was found in Firefox before version 85.0. The browser
could have been confused into transferring a screen sharing state into
another tab, which would leak unintended information.
A security issue was found in Firefox before version 85.0 and
Thunderbird before version 78.7. Performing garbage collection on re-
declared JavaScript variables resulted in a use-after-poison, and a
potentially exploitable crash.
A security issue was found in Firefox before version 85.0. Further
techniques that built on the slipstream research combined with a
malicious webpage could have exposed both an internal network’s hosts
as well as services running on the user’s local machine.
A security issue was found in Firefox before version 85.0. Incorrect
use of the RowCountChanged method could have led to a use-after-poison
and a potentially exploitable crash.
A security issue was found in Firefox before version 85.0. When sharing
geolocation during an active WebRTC share, Firefox could have reset the
webRTC sharing state in the user interface, leading to loss of control
over the currently granted permission.
A security issue was found in Firefox before version 85.0 and
Thunderbird before version 78.7. Mozilla developers reported memory
safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these
bugs showed evidence of memory corruption and Mozilla presumes that
with enough effort some of these could have been exploited to run
arbitrary code.
A security issue was found in Firefox before version 85.0. Mozilla
developers reported memory safety bugs present in Firefox 84. Some of
these bugs showed evidence of memory corruption and Mozilla presumes
that with enough effort some of these could have been exploited to run
arbitrary code.
A remote attacker might be able to perform click-jacking attacks,
access sensitive information or execute arbitrary code.
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23953
https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23953
https://bugzilla.mozilla.org/show_bug.cgi?id=1683940
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23954
https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23954
https://bugzilla.mozilla.org/show_bug.cgi?id=1684020
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23955
https://bugzilla.mozilla.org/show_bug.cgi?id=1684837
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23956
https://bugzilla.mozilla.org/show_bug.cgi?id=1338637
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23958
https://bugzilla.mozilla.org/show_bug.cgi?id=1642747
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23960
https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23960
https://bugzilla.mozilla.org/show_bug.cgi?id=1675755
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23961
https://bugzilla.mozilla.org/show_bug.cgi?id=1677940
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23962
https://bugzilla.mozilla.org/show_bug.cgi?id=1677194
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23963
https://bugzilla.mozilla.org/show_bug.cgi?id=1680793
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23964
https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23964
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662507%2C1666285%2C1673526%2C1674278%2C1674835%2C1675097%2C1675844%2C1675868%2C1677590%2C1677888%2C1680410%2C1681268%2C1682068%2C1682938%2C1683736%2C1685260%2C1685925
https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23965
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1670378%2C1673555%2C1676812%2C1678582%2C1684497
https://security.archlinux.org/CVE-2021-23953
https://security.archlinux.org/CVE-2021-23954
https://security.archlinux.org/CVE-2021-23955
https://security.archlinux.org/CVE-2021-23956
https://security.archlinux.org/CVE-2021-23958
https://security.archlinux.org/CVE-2021-23960
https://security.archlinux.org/CVE-2021-23961
https://security.archlinux.org/CVE-2021-23962
https://security.archlinux.org/CVE-2021-23963
https://security.archlinux.org/CVE-2021-23964
https://security.archlinux.org/CVE-2021-23965
bugzilla.mozilla.org/buglist.cgi?bug_id=1662507%2C1666285%2C1673526%2C1674278%2C1674835%2C1675097%2C1675844%2C1675868%2C1677590%2C1677888%2C1680410%2C1681268%2C1682068%2C1682938%2C1683736%2C1685260%2C1685925
bugzilla.mozilla.org/buglist.cgi?bug_id=1670378%2C1673555%2C1676812%2C1678582%2C1684497
bugzilla.mozilla.org/show_bug.cgi?id=1338637
bugzilla.mozilla.org/show_bug.cgi?id=1642747
bugzilla.mozilla.org/show_bug.cgi?id=1675755
bugzilla.mozilla.org/show_bug.cgi?id=1677194
bugzilla.mozilla.org/show_bug.cgi?id=1677940
bugzilla.mozilla.org/show_bug.cgi?id=1680793
bugzilla.mozilla.org/show_bug.cgi?id=1683940
bugzilla.mozilla.org/show_bug.cgi?id=1684020
bugzilla.mozilla.org/show_bug.cgi?id=1684837
security.archlinux.org/AVG-1492
security.archlinux.org/CVE-2021-23953
security.archlinux.org/CVE-2021-23954
security.archlinux.org/CVE-2021-23955
security.archlinux.org/CVE-2021-23956
security.archlinux.org/CVE-2021-23958
security.archlinux.org/CVE-2021-23960
security.archlinux.org/CVE-2021-23961
security.archlinux.org/CVE-2021-23962
security.archlinux.org/CVE-2021-23963
security.archlinux.org/CVE-2021-23964
security.archlinux.org/CVE-2021-23965
www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23953
www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23954
www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23955
www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23956
www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23958
www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23960
www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23961
www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23962
www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23963
www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23964
www.mozilla.org/en-US/security/advisories/mfsa2021-03/#CVE-2021-23965
www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23953
www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23954
www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23960
www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2021-23964
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
82.5%