vuln-list-alt/oval/c10f1/ALT-PU-2021-1162/definitions.json
2024-12-12 21:07:30 +00:00

435 lines
22 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20211162",
"Version": "oval:org.altlinux.errata:def:20211162",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2021-1162: package `firefox` update to version 85.0-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2021-1162",
"RefURL": "https://errata.altlinux.org/ALT-PU-2021-1162",
"Source": "ALTPU"
},
{
"RefID": "BDU:2021-02079",
"RefURL": "https://bdu.fstec.ru/vul/2021-02079",
"Source": "BDU"
},
{
"RefID": "BDU:2021-02080",
"RefURL": "https://bdu.fstec.ru/vul/2021-02080",
"Source": "BDU"
},
{
"RefID": "BDU:2021-02081",
"RefURL": "https://bdu.fstec.ru/vul/2021-02081",
"Source": "BDU"
},
{
"RefID": "BDU:2021-02082",
"RefURL": "https://bdu.fstec.ru/vul/2021-02082",
"Source": "BDU"
},
{
"RefID": "BDU:2021-02083",
"RefURL": "https://bdu.fstec.ru/vul/2021-02083",
"Source": "BDU"
},
{
"RefID": "BDU:2021-02084",
"RefURL": "https://bdu.fstec.ru/vul/2021-02084",
"Source": "BDU"
},
{
"RefID": "BDU:2021-02085",
"RefURL": "https://bdu.fstec.ru/vul/2021-02085",
"Source": "BDU"
},
{
"RefID": "BDU:2021-02086",
"RefURL": "https://bdu.fstec.ru/vul/2021-02086",
"Source": "BDU"
},
{
"RefID": "BDU:2021-02087",
"RefURL": "https://bdu.fstec.ru/vul/2021-02087",
"Source": "BDU"
},
{
"RefID": "BDU:2021-02088",
"RefURL": "https://bdu.fstec.ru/vul/2021-02088",
"Source": "BDU"
},
{
"RefID": "BDU:2021-02089",
"RefURL": "https://bdu.fstec.ru/vul/2021-02089",
"Source": "BDU"
},
{
"RefID": "BDU:2021-02090",
"RefURL": "https://bdu.fstec.ru/vul/2021-02090",
"Source": "BDU"
},
{
"RefID": "CVE-2021-23953",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23953",
"Source": "CVE"
},
{
"RefID": "CVE-2021-23954",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23954",
"Source": "CVE"
},
{
"RefID": "CVE-2021-23955",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23955",
"Source": "CVE"
},
{
"RefID": "CVE-2021-23956",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23956",
"Source": "CVE"
},
{
"RefID": "CVE-2021-23957",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23957",
"Source": "CVE"
},
{
"RefID": "CVE-2021-23958",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23958",
"Source": "CVE"
},
{
"RefID": "CVE-2021-23959",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23959",
"Source": "CVE"
},
{
"RefID": "CVE-2021-23960",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23960",
"Source": "CVE"
},
{
"RefID": "CVE-2021-23961",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23961",
"Source": "CVE"
},
{
"RefID": "CVE-2021-23962",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23962",
"Source": "CVE"
},
{
"RefID": "CVE-2021-23963",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23963",
"Source": "CVE"
},
{
"RefID": "CVE-2021-23964",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23964",
"Source": "CVE"
},
{
"RefID": "CVE-2021-23965",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23965",
"Source": "CVE"
}
],
"Description": "This update upgrades firefox to version 85.0-alt1. \nSecurity Fix(es):\n\n * BDU:2021-02079: Уязвимость браузера Mozilla Firefox, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2021-02080: Уязвимость расширения WebRTC браузера Mozilla Firefox, позволяющая нарушителю оказать воздействие на целостность данных\n\n * BDU:2021-02081: Уязвимость метода \u0026lt;RowCountChanged\u0026gt; браузера Mozilla Firefox, позволяющая нарушителю повысить свои привилегии или вызвать отказ в обслуживании\n\n * BDU:2021-02082: Уязвимость браузера Mozilla Firefox, связанная с раскрытием информации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * BDU:2021-02083: Уязвимость браузера Mozilla Firefox, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю осуществлять межсайтовые сценарные атаки\n\n * BDU:2021-02084: Уязвимость браузера Mozilla Firefox, связанная с ошибками управления ресурсами, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * BDU:2021-02085: Уязвимость изолированной среды iframe браузера Firefox for Android, позволяющая нарушителю оказать воздействие на целостность данных\n\n * BDU:2021-02086: Уязвимость браузера Mozilla Firefox, связанная с ошибками представления информации пользовательским интерфейсом, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * BDU:2021-02087: Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с ошибкой преобразования типов, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2021-02088: Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2021-02089: Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с включением функций из недостоверной контролируемой области, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * BDU:2021-02090: Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с некорректной обработкой нулевых байтов или символов NULL при обмене данными, позволяющая нарушителю повысить свои привилегии или вызвать отказ в обслуживании\n\n * CVE-2021-23953: If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. This vulnerability affects Firefox \u003c 85, Thunderbird \u003c 78.7, and Firefox ESR \u003c 78.7.\n\n * CVE-2021-23954: Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects Firefox \u003c 85, Thunderbird \u003c 78.7, and Firefox ESR \u003c 78.7.\n\n * CVE-2021-23955: The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks. This vulnerability affects Firefox \u003c 85.\n\n * CVE-2021-23956: An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. This was addressed by adding a new prompt. This vulnerability affects Firefox \u003c 85.\n\n * CVE-2021-23957: Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox \u003c 85.\n\n * CVE-2021-23958: The browser could have been confused into transferring a screen sharing state into another tab, which would leak unintended information. This vulnerability affects Firefox \u003c 85.\n\n * CVE-2021-23959: An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox \u003c 85.\n\n * CVE-2021-23960: Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This vulnerability affects Firefox \u003c 85, Thunderbird \u003c 78.7, and Firefox ESR \u003c 78.7.\n\n * CVE-2021-23961: Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox \u003c 85.\n\n * CVE-2021-23962: Incorrect use of the '\u003cRowCountChanged\u003e' method could have led to a user-after-poison and a potentially exploitable crash. This vulnerability affects Firefox \u003c 85.\n\n * CVE-2021-23963: When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission. This vulnerability affects Firefox \u003c 85.\n\n * CVE-2021-23964: Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 85, Thunderbird \u003c 78.7, and Firefox ESR \u003c 78.7.\n\n * CVE-2021-23965: Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 85.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2021-01-27"
},
"Updated": {
"Date": "2021-01-27"
},
"BDUs": [
{
"ID": "BDU:2021-02079",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"CWE": "CWE-119",
"Href": "https://bdu.fstec.ru/vul/2021-02079",
"Impact": "High",
"Public": "20210126"
},
{
"ID": "BDU:2021-02080",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"CWE": "CWE-281",
"Href": "https://bdu.fstec.ru/vul/2021-02080",
"Impact": "Low",
"Public": "20210126"
},
{
"ID": "BDU:2021-02081",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"CWE": "CWE-119",
"Href": "https://bdu.fstec.ru/vul/2021-02081",
"Impact": "High",
"Public": "20210126"
},
{
"ID": "BDU:2021-02082",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"CWE": "CWE-200",
"Href": "https://bdu.fstec.ru/vul/2021-02082",
"Impact": "High",
"Public": "20210126"
},
{
"ID": "BDU:2021-02083",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"CWE": "CWE-79",
"Href": "https://bdu.fstec.ru/vul/2021-02083",
"Impact": "Low",
"Public": "20210126"
},
{
"ID": "BDU:2021-02084",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"CWE": "CWE-399",
"Href": "https://bdu.fstec.ru/vul/2021-02084",
"Impact": "Low",
"Public": "20210126"
},
{
"ID": "BDU:2021-02085",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:C/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
"CWE": "CWE-264",
"Href": "https://bdu.fstec.ru/vul/2021-02085",
"Impact": "High",
"Public": "20210126"
},
{
"ID": "BDU:2021-02086",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"CWE": "CWE-451",
"Href": "https://bdu.fstec.ru/vul/2021-02086",
"Impact": "Low",
"Public": "20210126"
},
{
"ID": "BDU:2021-02087",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"CWE": "CWE-843",
"Href": "https://bdu.fstec.ru/vul/2021-02087",
"Impact": "High",
"Public": "20210126"
},
{
"ID": "BDU:2021-02088",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"CWE": "CWE-119",
"Href": "https://bdu.fstec.ru/vul/2021-02088",
"Impact": "High",
"Public": "20210126"
},
{
"ID": "BDU:2021-02089",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"CWE": "CWE-829",
"Href": "https://bdu.fstec.ru/vul/2021-02089",
"Impact": "Low",
"Public": "20210126"
},
{
"ID": "BDU:2021-02090",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"CWE": "CWE-626",
"Href": "https://bdu.fstec.ru/vul/2021-02090",
"Impact": "High",
"Public": "20210126"
}
],
"CVEs": [
{
"ID": "CVE-2021-23953",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"CWE": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23953",
"Impact": "Low",
"Public": "20210226"
},
{
"ID": "CVE-2021-23954",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"CWE": "CWE-843",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23954",
"Impact": "High",
"Public": "20210226"
},
{
"ID": "CVE-2021-23955",
"CVSS": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"CWE": "CWE-1021",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23955",
"Impact": "Low",
"Public": "20210226"
},
{
"ID": "CVE-2021-23956",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"CWE": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23956",
"Impact": "Low",
"Public": "20210226"
},
{
"ID": "CVE-2021-23957",
"CVSS": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
"CWE": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23957",
"Impact": "High",
"Public": "20210226"
},
{
"ID": "CVE-2021-23958",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"CWE": "CWE-668",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23958",
"Impact": "Low",
"Public": "20210226"
},
{
"ID": "CVE-2021-23959",
"CVSS": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"CWE": "CWE-79",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23959",
"Impact": "Low",
"Public": "20210226"
},
{
"ID": "CVE-2021-23960",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"CWE": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23960",
"Impact": "High",
"Public": "20210226"
},
{
"ID": "CVE-2021-23961",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"CWE": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23961",
"Impact": "High",
"Public": "20210226"
},
{
"ID": "CVE-2021-23962",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"CWE": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23962",
"Impact": "High",
"Public": "20210226"
},
{
"ID": "CVE-2021-23963",
"CVSS": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"CWE": "CWE-281",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23963",
"Impact": "Low",
"Public": "20210226"
},
{
"ID": "CVE-2021-23964",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"CWE": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23964",
"Impact": "High",
"Public": "20210226"
},
{
"ID": "CVE-2021-23965",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"CWE": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23965",
"Impact": "High",
"Public": "20210226"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:5001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20211162001",
"Comment": "firefox is earlier than 0:85.0-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20211162002",
"Comment": "firefox-config-privacy is earlier than 0:85.0-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20211162003",
"Comment": "firefox-wayland is earlier than 0:85.0-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20211162004",
"Comment": "rpm-build-firefox is earlier than 0:85.0-alt1"
}
]
}
]
}
}
]
}