[ GLSA 202101-04 ] Mozilla Firefox

[GLSA]

Gentoo Linux Security Advisory

Title: Mozilla Firefox: Remote code execution (GLSA 202101-04)
Severity: normal
Exploitable: remote
Date: 2021-01-10
Bug(s): #764161
ID: 202101-04

Synopsis

A use-after-free in Mozilla Firefox's SCTP handling may allow
remote code execution.


Background

Mozilla Firefox is a popular open-source web browser from the Mozilla
project.


Affected Packages

Package: www-client/firefox
Vulnerable: < 84.0.2
Unaffected: >= 78.6.1
Unaffected: >= 84.0.2
Architectures: All supported architectures

Package: www-client/firefox-bin
Vulnerable: < 84.0.2
Unaffected: >= 78.6.1
Unaffected: >= 84.0.2
Architectures: All supported architectures


Description

A use-after-free bug was discovered in Mozilla Firefox’s handling of
SCTP.


Impact

A remote attacker could possibly execute arbitrary code with the
privileges of the process, or cause a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All Firefox ESR users should upgrade to the latest version: