767334 – (CVE-2021-23955, CVE-2021-23956, CVE-2021-23958, CVE-2021-23962, CVE-2021-23963, CVE-2021-23965, CVE-2021-26976, MFSA-2021-03, MFSA-2021-04) <www-client/firefox{,-bin}-{78.7.0,85.0}: multiple vulnerabilities (MFSA2021-{03,04})

Bug 767334 (CVE-2021-23955, CVE-2021-23956, CVE-2021-23958, CVE-2021-23962, CVE-2021-23963, CVE-2021-23965, CVE-2021-26976, MFSA-2021-03, MFSA-2021-04) - <www-client/firefox{,-bin}-{78.7.0,85.0}: multiple vulnerabilities (MFSA2021-{03,04})

Summary: <www-client/firefox{,-bin}-{78.7.0,85.0}: multiple vulnerabilities (MFSA2021-...

Status:	RESOLVED FIXED

Alias:	CVE-2021-23955, CVE-2021-23956, CVE-2021-23958, CVE-2021-23962, CVE-2021-23963, CVE-2021-23965, CVE-2021-26976, MFSA-2021-03, MFSA-2021-04

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal major (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:	A2 [glsa+ cve]
Keywords:

Depends on:	CVE-2021-23961
Blocks:	CVE-2021-23953, CVE-2021-23954, CVE-2021-23960, CVE-2021-23964
	Show dependency tree

Reported:	2021-01-26 18:12 UTC by John Helmert III
Modified:	2021-04-20 21:29 UTC (History)
CC List:	1 user (show)

See Also:
Package list:	www-client/firefox-78.7.0
Runtime testing required:	---

Flags:	nattka: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2021-01-26 18:12:37 UTC

ESR advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2021-04/
85.0 advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2021-03/

Highest severity vulnerability in ESR was CVE-2021-23953:

If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data.

Comment 1 John Helmert III archtester

2021-01-26 18:14:47 UTC

Actually, at the bottom of the advisories there's the normal memory safety fixes which are presumed to be able to produce code execution exploits. CVE-2021-{23964,23965}.

Comment 2 Sam James archtester

2021-01-30 18:40:32 UTC

x86 done

Comment 3 Sam James archtester

2021-01-31 21:48:15 UTC

amd64 done

Comment 4 Sam James archtester

2021-01-31 21:49:19 UTC

arm64 done

all arches done

Comment 5 GLSAMaker/CVETool Bot gentoo-dev

2021-02-01 01:41:50 UTC

This issue was resolved and addressed in
 GLSA 202102-01 at https://security.gentoo.org/glsa/202102-01
by GLSA coordinator Aaron Bauman (b-man).

Comment 6 Aaron Bauman (RETIRED) gentoo-dev

2021-02-01 01:42:37 UTC

re-opened for cleanup

Comment 7 Larry the Git Cow gentoo-dev

2021-02-01 05:55:11 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=311b1adcad283bca8c383ad3f807143df090c077

commit 311b1adcad283bca8c383ad3f807143df090c077
Author:     Joonas Niilola <juippis@gentoo.org>
AuthorDate: 2021-02-01 05:53:55 +0000
Commit:     Joonas Niilola <juippis@gentoo.org>
CommitDate: 2021-02-01 05:54:41 +0000

    www-client/firefox-bin: security cleanup
    
    Bug: https://bugs.gentoo.org/767334
    Signed-off-by: Joonas Niilola <juippis@gentoo.org>

 www-client/firefox-bin/Manifest                  |  97 ------
 www-client/firefox-bin/firefox-bin-78.6.1.ebuild | 411 -----------------------
 2 files changed, 508 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8b0ec6a4a863a7a31980028678f6ffd7d5e96557

commit 8b0ec6a4a863a7a31980028678f6ffd7d5e96557
Author:     Joonas Niilola <juippis@gentoo.org>
AuthorDate: 2021-02-01 05:53:26 +0000
Commit:     Joonas Niilola <juippis@gentoo.org>
CommitDate: 2021-02-01 05:54:40 +0000

    www-client/firefox: security cleanup
    
    Bug: https://bugs.gentoo.org/767334
    Signed-off-by: Joonas Niilola <juippis@gentoo.org>

 www-client/firefox/Manifest              |   96 ---
 www-client/firefox/firefox-78.6.1.ebuild | 1130 ------------------------------
 2 files changed, 1226 deletions(-)

Comment 8 Sam James archtester

2021-02-01 06:02:11 UTC

Thanks! All done.

Comment 9 Thomas Deutschmann (RETIRED) gentoo-dev

2021-04-20 21:28:12 UTC

Freeing CVE-2021-23961 for tracker creation.