The Mozilla Foundation has patched four High risk vulnerabilities in Firefox 93, as well as added a security feature that blocks unsafe downloads.
An attacker could exploit these vulnerabilities to take control of impacted systems.
As part of Mozilla Foundation Security Advisory 2021-43, Firefox 93 addressed the following four High severity vulnerabilities:
- CVE-2021-38496: Use-after-free in MessageTask
- CVE-2021-38500: Memory safety bugs
- CVE-2021-38501: Memory safety bugs
- CVE-2021-38499: Memory safety bugs.
The three memory safety bugs could allow an attacker to exploit and then run arbitrary code. To add, three other Moderate rated vulnerabilities were also patched.
Moreover, the latest release of Firefox 93 includes a number of new features and security improvements. For instance, Firefox now blocks unsafe downloads that rely on insecure connections (e.g., HTTP downloads on a secure HTTPS page or downloads in a sandboxed iframe without the allow-downloads attribute explicitly annotated).
Mozilla also disabled TLS ciphersuites that use the deprecated 3DES cryptographic algorithm.
Finally, Mozilla also released security updates for Firefox ESR 78.15 and Firefox ESR 91.2.
Related Articles
- Mozilla patches 4 High risk vulnerabilities in Firefox 93
- Mozilla patches 3 High risk vulnerabilities in Firefox 92
- Mozilla patches High risk vulnerability in Firefox 91.0.1
- Mozilla releases Firefox 90 with new version of SmartBlock and 9 security fixes