KLA12374 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to spoof user interface, perform cross-site scripting attack, obtain sensitive information, cause denial of service, bypass security restrictions, execute arbitrary code.

Below is a complete list of vulnerabilities:

1. Security UI vulnerability can be exploited to spoof user interface.
2. Cross-site scripting (XSS) vulnerability for Android can be exploited to perform cross-site scripting attack.
3. Information disclosure vulnerability in XMLHttpRequest can be exploited to obtain sensitive information.
4. Denial of service vulnerability in Location API can be exploited to cause denial of service.
5. Information disclosure vulnerability in asynchronous function can be exploited to obtain sensitive information.
6. Security bypass vulnerability in CSP sandbox directive can be exploited to bypass security restrictions.
7. Heap buffer overflow vulnerability in structured clone can be exploited to cause denial of service.
8. Use after free vulnerability in GC can be exploited to cause denial of service.
9. Security UI vulnerability in full screen and pointer lock can be exploited to spoof user interface.
10. Security UI vulnerability in cursor can be exploited to spoof user interface.
11. Security bypass vulnerability in WebExtensions can be exploited to bypass security restrictions.
12. Use after free vulnerability in fullscreen objects on MacOS can be exploited to cause denial of service.
13. Memory safety vulnerability can be exploited to execute arbitrary code.

Original advisories

MFSA2021-52

Related products

Mozilla-Firefox

CVE list

CVE-2021-43541 high

CVE-2021-43544 high

CVE-2021-43542 high

CVE-2021-43545 high

CVE-2021-43536 high

CVE-2021-43543 high

CVE-2021-43537 critical

CVE-2021-43539 critical

CVE-2021-43538 warning

CVE-2021-43546 warning

CVE-2021-43540 high

CVE-2021-4128 high

CVE-2021-4129 critical

Solution

Update to the latest version

Download Firefox

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Mozilla Firefox earlier than 95