305 lines
15 KiB
JSON
305 lines
15 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20211718",
|
||
"Version": "oval:org.altlinux.errata:def:20211718",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2021-1718: package `firefox-esr` update to version 78.10.0-alt0.1.c9",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch c9f2"
|
||
],
|
||
"Products": [
|
||
"ALT SPWorkstation",
|
||
"ALT SPServer"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2021-1718",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2021-1718",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-02082",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-02082",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-02279",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-02279",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-02280",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-02280",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-02281",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-02281",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-02282",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-02282",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-02283",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-02283",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-02284",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-02284",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-02285",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-02285",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-23961",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23961",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-23994",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23994",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-23995",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23995",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-23998",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23998",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-23999",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-23999",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-24002",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-24002",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-29945",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-29945",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-29946",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-29946",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades firefox-esr to version 78.10.0-alt0.1.c9. \nSecurity Fix(es):\n\n * BDU:2021-02082: Уязвимость браузера Mozilla Firefox, связанная с раскрытием информации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * BDU:2021-02279: Уязвимость компонента WebGL почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2021-02280: Уязвимость режима адаптивного дизайна (Responsive Design Mode) почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2021-02281: Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, связанная с ошибками при сохранении разрешений, позволяющая нарушителю ошибочно присвоить сертификат безопасности HTTP-странице\n\n * BDU:2021-02282: Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, связанная с ошибками наследуемых разрешений, позволяющая нарушителю повысить свои привилегии\n\n * BDU:2021-02283: Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, связанная с ошибками при обработке символов новой строки в URL-адресе FTP, позволяющая нарушителю отправлять произвольные команды на FTP-сервер\n\n * BDU:2021-02284: Уязвимость компонента JIT WebAssembly почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2021-02285: Уязвимость почтового клиента Thunderbird, браузеров Firefox и Firefox ESR, существующая из-за недостаточной проверки входных данных, позволяющая нарушителю обойти ограничения безопасности\n\n * CVE-2021-23961: Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox \u003c 85.\n\n * CVE-2021-23994: A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR \u003c 78.10, Thunderbird \u003c 78.10, and Firefox \u003c 88.\n\n * CVE-2021-23995: When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 78.10, Thunderbird \u003c 78.10, and Firefox \u003c 88.\n\n * CVE-2021-23998: Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR \u003c 78.10, Thunderbird \u003c 78.10, and Firefox \u003c 88.\n\n * CVE-2021-23999: If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR \u003c 78.10, Thunderbird \u003c 78.10, and Firefox \u003c 88.\n\n * CVE-2021-24002: When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR \u003c 78.10, Thunderbird \u003c 78.10, and Firefox \u003c 88.\n\n * CVE-2021-29945: The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. *Note: This issue only affected x86-32 platforms. Other platforms are unaffected.*. This vulnerability affects Firefox ESR \u003c 78.10, Thunderbird \u003c 78.10, and Firefox \u003c 88.\n\n * CVE-2021-29946: Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR \u003c 78.10, Thunderbird \u003c 78.10, and Firefox \u003c 88.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "High",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2021-04-26"
|
||
},
|
||
"Updated": {
|
||
"Date": "2021-04-26"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2021-02082",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
|
||
"CWE": "CWE-200",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-02082",
|
||
"Impact": "High",
|
||
"Public": "20210126"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-02279",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-787",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-02279",
|
||
"Impact": "High",
|
||
"Public": "20210419"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-02280",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-416",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-02280",
|
||
"Impact": "High",
|
||
"Public": "20210419"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-02281",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:P/A:N",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
|
||
"CWE": "CWE-277, CWE-281",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-02281",
|
||
"Impact": "High",
|
||
"Public": "20210419"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-02282",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||
"CWE": "CWE-277",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-02282",
|
||
"Impact": "Low",
|
||
"Public": "20210419"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-02283",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
|
||
"CVSS3": "AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
|
||
"CWE": "CWE-20",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-02283",
|
||
"Impact": "Low",
|
||
"Public": "20210419"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-02284",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
|
||
"CWE": "CWE-682",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-02284",
|
||
"Impact": "Low",
|
||
"Public": "20210419"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-02285",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
|
||
"CVSS3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
|
||
"CWE": "CWE-20",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-02285",
|
||
"Impact": "Low",
|
||
"Public": "20210419"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2021-23961",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
|
||
"CWE": "NVD-CWE-noinfo",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23961",
|
||
"Impact": "High",
|
||
"Public": "20210226"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-23994",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-909",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23994",
|
||
"Impact": "High",
|
||
"Public": "20210624"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-23995",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-672",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23995",
|
||
"Impact": "High",
|
||
"Public": "20210624"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-23998",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
|
||
"CWE": "CWE-345",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23998",
|
||
"Impact": "Low",
|
||
"Public": "20210624"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-23999",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-269",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-23999",
|
||
"Impact": "High",
|
||
"Public": "20210624"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-24002",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-74",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-24002",
|
||
"Impact": "High",
|
||
"Public": "20210624"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-29945",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-682",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-29945",
|
||
"Impact": "Low",
|
||
"Public": "20210624"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-29946",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-190",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-29946",
|
||
"Impact": "High",
|
||
"Public": "20210624"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:spworkstation:8.4",
|
||
"cpe:/o:alt:spserver:8.4"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:3001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20211718001",
|
||
"Comment": "firefox-esr is earlier than 0:78.10.0-alt0.1.c9"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20211718002",
|
||
"Comment": "firefox-esr-config-privacy is earlier than 0:78.10.0-alt0.1.c9"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20211718003",
|
||
"Comment": "firefox-esr-wayland is earlier than 0:78.10.0-alt0.1.c9"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |