Lucene search

K
archlinuxArchLinuxASA-202006-1
HistoryJun 02, 2020 - 12:00 a.m.

[ASA-202006-1] firefox: multiple issues

2020-06-0200:00:00
security.archlinux.org
23

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.003 Low

EPSS

Percentile

67.0%

Arch Linux Security Advisory ASA-202006-1

Severity: High
Date : 2020-06-02
CVE-ID : CVE-2020-12399 CVE-2020-12405 CVE-2020-12406 CVE-2020-12407
CVE-2020-12408 CVE-2020-12409 CVE-2020-12410 CVE-2020-12411
Package : firefox
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1173

Summary

The package firefox before version 77.0-1 is vulnerable to multiple
issues including arbitrary code execution, denial of service, private
key recovery and content spoofing.

Resolution

Upgrade to 77.0-1.

pacman -Syu “firefox>=77.0-1”

The problems have been fixed upstream in version 77.0.

Workaround

None.

Description

  • CVE-2020-12399 (private key recovery)

NSS before 3.52.1, as used in Firefox before 77.0 and Thunderbird
before 68.9.0, has shown timing differences when performing DSA
signatures, which was exploitable and could eventually leak private
keys.

  • CVE-2020-12405 (denial of service)

When browsing a malicious page in Firefox before 77.0 and Thunderbird
before 68.9.0, a race condition in our SharedWorkerService could occur
and lead to a potentially exploitable crash.

  • CVE-2020-12406 (arbitrary code execution)

Mozilla Developer Iain Ireland discovered a missing type check in
Firefox before 77.0 and Thunderbird before 68.9.0 during unboxed
objects removal, resulting in a crash. We presume that with enough
effort that it could be exploited to run arbitrary code.

  • CVE-2020-12407 (denial of service)

Mozilla Developer Nicolas Silva found that when using WebRender,
Firefox would under certain conditions leak arbitrary GPU memory to the
visible screen. The leaked memory content was visible to the user, but
not observable from web content.

  • CVE-2020-12408 (content spoofing)

When browsing a document hosted on an IP address, an attacker could
insert certain characters to flip domain and path information in the
address bar.

  • CVE-2020-12409 (content spoofing)

When using certain blank characters in a URL, they where incorrectly
rendered as spaces instead of an encoded URL.

  • CVE-2020-12410 (arbitrary code execution)

Mozilla developers Tom Tung and Karl Tomlinson reported memory safety
bugs present in Firefox 76, Firefox ESR 68.8 and Thunderbird before
68.9.0. Some of these bugs showed evidence of memory corruption and
Mozilla presumes that with enough effort some of these could have been
exploited to run arbitrary code.

  • CVE-2020-12411 (arbitrary code execution)

Mozilla developers :Gijs (he/him), Randell Jesup reported memory safety
bugs present in Firefox 76. Some of these bugs showed evidence of
memory corruption and we presume that with enough effort some of these
could have been exploited to run arbitrary code.

Impact

A remote attacker might be able to recover private keys, spoof content,
execute arbitrary code or crash the application.

References

https://www.mozilla.org/en-US/security/advisories/mfsa2020-20/
https://bugzilla.mozilla.org/show_bug.cgi?id=1631576
https://hg.mozilla.org/projects/nss/rev/daa823a4a29bcef0fec33a379ec83857429aea2e
https://bugzilla.mozilla.org/show_bug.cgi?id=1631618
https://bugzilla.mozilla.org/show_bug.cgi?id=1639590
https://bugzilla.mozilla.org/show_bug.cgi?id=1637112
https://bugzilla.mozilla.org/show_bug.cgi?id=1623888
https://bugzilla.mozilla.org/show_bug.cgi?id=1629506
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1619305%2C1632717
https://bugzilla.mozilla.org/show_bug.cgi?id=1506173
https://security.archlinux.org/CVE-2020-12399
https://security.archlinux.org/CVE-2020-12405
https://security.archlinux.org/CVE-2020-12406
https://security.archlinux.org/CVE-2020-12407
https://security.archlinux.org/CVE-2020-12408
https://security.archlinux.org/CVE-2020-12409
https://security.archlinux.org/CVE-2020-12410
https://security.archlinux.org/CVE-2020-12411

OSVersionArchitecturePackageVersionFilename
ArchLinuxanyanyfirefox< 77.0-1UNKNOWN

References

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.003 Low

EPSS

Percentile

67.0%