Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring has applied security fixes for its use of Mozilla Firefox

Vulnerability Details

CVEID:   CVE-2021-23994
DESCRIPTION:   Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by by an out-of-bounds write during lazy initialization. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
CVSS Base score: 8.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/200186 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID:   CVE-2021-23998
DESCRIPTION:   Mozilla Firefox could allow a remote attacker to conduct spoofing attacks, caused by complicated navigations with new windows. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof a secure lock icon.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/200190 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

CVEID:   CVE-2021-23999
DESCRIPTION:   Mozilla Firefox could allow a remote attacker to gain elevated privileges on the system, caused by the loading of a Blob URL by the System Principal. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to gain elevated privileges on the system.
CVSS Base score: 8.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/200191 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID:   CVE-2021-29946
DESCRIPTION:   Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by use of ports that were written as an integer overflow above the bounds of a 16-bit integer in the Alt-Svc header. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to bypass port blocking.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/200197 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)