QID 630669

Date Published: 2021-04-07

QID 630669: Mozilla Firefox for Android and iOS Multiple Vulnerabilities (MFSA2021-07)

Firefox is a free and open-source web browser developed for Windows, OS X, and Linux, with a mobile version for Android.

CVE-2021-23969: Content Security Policy violation report could have contained the destination of a redirect.
CVE-2021-23970: Multithreaded WASM triggered assertions validating separation of script domains.
CVE-2021-23968: Content Security Policy violation report could have contained the destination of a redirect.
CVE-2021-23974: noscript elements could have led to an HTML Sanitizer bypass.
CVE-2021-23971: A website's Referrer-Policy could have been be overridden, potentially resulting in the full URL being sent as a Referrer.
CVE-2021-23972: HTTP Auth phishing warning was omitted when a redirect is cached.
CVE-2021-23975: about:memory Measure function caused an incorrect pointer operation.
CVE-2021-23973: MediaError message property could have leaked information about cross-origin resources.
CVE-2021-23979: Memory safety bugs fixed in Firefox 86.

Affected Products:
Prior to Firefox 86

On successful exploitation it could allow to compromise integrity, availability and confidentiality.

CVSS V3 rated as Critical - 8.8 severity.

CVSS V2 rated as High - 6.8 severity.

Solution

Vendor has released fix to address these vulnerabilities. Refer to MFSA 2021-07

Vendor References

MFSA2021-07 - www.mozilla.org/en-US/security/advisories/mfsa2021-07/

CVEs related to QID 630669

CVE-2021-23969 | CVE-2021-23970 | CVE-2021-23968 | CVE-2021-23974 | CVE-2021-23971 | CVE-2021-23972 | CVE-2021-23975 | CVE-2021-23973 | CVE-2021-23979 | CVE-2021-23976 | CVE-2021-23977 |

Software Advisories

Advisory ID	Software	Component	Link
mfsa2021-07	Android		www.mozilla.org/en-US/security/advisories/mfsa2021-07/
mfsa2021-07	iOS		www.mozilla.org/en-US/security/advisories/mfsa2021-07/

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].