Rewterz Threat Advisory – Multiple Mozilla Firefox Vulnerabilities

Severity

High

Analysis Summary

CVE-2021-29969

Mozilla Thunderbird could allow a remote attacker to obtain sensitive information, caused by the failure to ignore injected data when configured to use STARTTLS for an IMAP connection and the injection of IMAP server responses prior to the completion of the STARTTLS handshake. A remote attacker could exploit this vulnerability to view folders that didn’t exist on the IMAP server.

CVE-2021-29970

Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in accessibility features of a document. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service

CVE-2021-29969

Mozilla Thunderbird could allow a remote attacker to obtain sensitive information, caused by the failure to ignore injected data when configured to use STARTTLS for an IMAP connection and the injection of IMAP server responses prior to the completion of the STARTTLS handshake. A remote attacker could exploit this vulnerability to view folders that didn’t exist on the IMAP server.

CVE-2021-29970

Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in accessibility features of a document. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service

CVE-2021-29976

Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.

CVE-2021-29977

Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.

CVE-2021-29972

Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in an out-of-date Cairo library. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.

CVE-2021-29975

Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by an error when overlaying text messages on top of another domain. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to cause user confusion.

CVE-2021-29974

Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by the enablement of network partitioning. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to override an error on a domain which had specified HTTP Strict Transport Security.

CVE-2021-29973

Mozilla Firefox for Android could allow a remote attacker to bypass security restrictions, caused by the enablement of the password autofill on HTTP websites without user interaction. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions.

CVE-2021-29971

Mozilla Firefox for Android could allow a remote attacker to bypass security restrictions. When the user grants permission to a webpage and saves that grant, an attacker could exploit this vulnerability to gain the permission irrespective of scheme or port.

Impact

• Bypass Security
• Denial of Service
• Code Execution
• Unauthorized Access

Affected Vendors

Mozilla

Mozilla Thunderbird 78.11
Mozilla Firefox 89.0
Mozilla Firefox ESR 78.11
Mozilla Firefox for Android 89

Remediation

Refer to Mozilla Foundation Security Advisory for the patch, upgrade, or suggested workaround information.

https://www.mozilla.org/en-US/security/advisories/mfsa2021-30/