Alpine: multiple firefox-esr packages: security update to 91.2.0-r0

critical Tenable Cloud Security Plugin ID 404456

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these
bugs showed evidence of memory corruption and we presume that with enough effort some of these could have
been exploited to run arbitrary code. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and
Firefox ESR < 91.2. (CVE-2021-38501)

- crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in
Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in
the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks
are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a
logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are
affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4. (CVE-2021-32810)

- When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might
allow attackers to launch pages and execute scripts in Internet Explorer in unprivileged mode. *This bug
only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects
Firefox < 92, Thunderbird < 91.1, Thunderbird < 78.14, Firefox ESR < 78.14, and Firefox ESR < 91.1.
(CVE-2021-38492)

- Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these
bugs showed evidence of memory corruption and we presume that with enough effort some of these could have
been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.14, Thunderbird < 78.14,
and Firefox < 92. (CVE-2021-38493)

- Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed
evidence of memory corruption and we presume that with enough effort some of these could have been
exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.1 and Firefox ESR < 91.1.
(CVE-2021-38495)

Plugin Details

Severity: Critical

ID: 404456

Version: Revision 1.43

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 12/4/2025

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-38501

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2021-32810

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 8/2/2021

Reference Information

CVE: CVE-2021-32810, CVE-2021-38492, CVE-2021-38493, CVE-2021-38495, CVE-2021-38496, CVE-2021-38497, CVE-2021-38498, CVE-2021-38500, CVE-2021-38501

Detections

Analytics