[ GLSA 202011-07 ] Mozilla Firefox

[GLSA]

Gentoo Linux Security Advisory

Title: Mozilla Firefox: Remote code execution (GLSA 202011-07)
Severity: normal
Exploitable: remote
Date: 2020-11-11
Bug(s): #753773
ID: 202011-07

Synopsis

A use-after-free in Mozilla Firefox might allow remote attacker(s)
to execute arbitrary code.


Background

Mozilla Firefox is a popular open-source web browser from the Mozilla
project.


Affected Packages

Package: www-client/firefox
Vulnerable: < 82.0.3
Unaffected: >= 82.0.3
Unaffected: >= 78.4.1
Architectures: All supported architectures

Package: www-client/firefox-bin
Vulnerable: < 78.4.1
Unaffected: >= 82.0.3
Unaffected: >= 78.4.1
Architectures: All supported architectures


Description

Invalid assumptions when emitting the the MCallGetProperty opcode in the
JavaScript JIT may result in a use-after-free condition.


Impact

A remote attacker could possibly execute arbitrary code with the
privileges of the process, or cause a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All Mozilla Firefox users should upgrade to the latest version: