Arbitrary Code Injection Affecting firefox-esr package, versions <78.9.0esr-1


0.0
medium

Snyk CVSS

    Attack Complexity High
    User Interaction Required
    Confidentiality High

    Threat Intelligence

    EPSS 0.23% (61st percentile)
Expand this section
NVD
5.3 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN12-FIREFOXESR-1546319
  • published 25 Jun 2021
  • disclosed 24 Jun 2021

How to fix?

Upgrade Debian:12 firefox-esr to version 78.9.0esr-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream firefox-esr package and not the firefox-esr package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.). This vulnerability affects Firefox ESR < 78.9 and Firefox < 87.