Security fix for the ALT Linux 10 package firefox-esr version 78.1.0-alt1

July 28, 2020 Andrey Cherepanov 78.1.0-alt1 - New release 78.1.0. - Fixes: + CVE-2020-15652 Potential leak of redirect targets when loading scripts in a worker + CVE-2020-6514 WebRTC data channel leaks internal address to peer + CVE-2020-15655 Extension APIs could be used to bypass Same-Origin...

KLA11920 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, bypass security restrictions, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Use after free vulnerabilit...

Security Vulnerabilities fixed in Firefox ESR 78.1 — Mozilla

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. WebRTC used the memory address of a class instance as a connection identifier. Unfortunately, this value is...

openSUSE Security Update : MozillaFirefox (openSUSE-2020-1042)

This update for MozillaFirefox fixes the following issues : - Mozilla Firefox 78.0.2 MFSA 2020-28 bsc1173948 - MFSA-2020-0003 bmo1644076 X-Frame-Options bypass using object or embed tags - Firefox Extended Support Release 78.0.2esr ESR - Fixed: Security fix - Fixed: Fixed an accessibility...

Important: thunderbird

Issue Overview: Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR 68.10, Firefox 78, and Thunderbird 68.10.0. CVE-2020-12418 When processing callbacks that occurred during...

SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:1958-1)

This update for MozillaFirefox fixes the following issues : Mozilla Firefox 78.0.2 MFSA 2020-28 bsc1173948 - MFSA-2020-0003 bmo1644076 X-Frame-Options bypass using object or embed tags Firefox Extended Support Release 78.0.2esr ESR - Fixed: Security fix - Fixed: Fixed an accessibility regression ...

openSUSE Security Update : MozillaThunderbird (openSUSE-2020-982)

This update for MozillaThunderbird to version 68.10.0 ESR fixes the following issues : - CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 bsc1173576. - CVE-2020-12418: Information disclosure due to manipulated URL object bsc1173576. - CVE-2020-12419:...

Security update for MozillaFirefox (important)

openSUSE Security Update: Security update for MozillaFirefox Announcement ID: openSUSE-SU-2020:1017-1 Rating: important References: 1166238 1173576 1173613 Cross-References: CVE-2020-12402 CVE-2020-12415 CVE-2020-12416 CVE-2020-12417 CVE-2020-12418 CVE-2020-12419 CVE-2020-12420 CVE-2020-12421...

SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2020:1899-1)

This update for MozillaFirefox to version 78.0.1 ESR fixes the following issues : Security issues fixed : CVE-2020-12415: AppCache manifest poisoning due to url encoded character processing bsc1173576. CVE-2020-12416: Use-after-free in WebRTC VideoBroadcaster bsc1173576. CVE-2020-12417: Memory...

SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:1898-1)

This update for MozillaFirefox to version 78.0.1 ESR fixes the following issues : Security issues fixed : CVE-2020-12415: AppCache manifest poisoning due to url encoded character processing bsc1173576. CVE-2020-12416: Use-after-free in WebRTC VideoBroadcaster bsc1173576. CVE-2020-12417: Memory...

Security update for MozillaThunderbird (important)

openSUSE Security Update: Security update for MozillaThunderbird Announcement ID: openSUSE-SU-2020:0967-1 Rating: important References: 1173576 Cross-References: CVE-2020-12417 CVE-2020-12418 CVE-2020-12419 CVE-2020-12420 CVE-2020-12421 Affected Products: openSUSE Leap 15.1 An update that fixes 5...

CVE-2020-12421

When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected even if they were legitimately added by an administrator. This could have caused add-ons to become out-of-date silently without notification to the user. This vulnerability affects Firefox ESR 68.10...

DEBIAN-CVE-2020-12417

Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash. Note: this issue only affects Firefox on ARM64 platforms. This vulnerability affects Firefox ESR 68.10, Firefox 78, and...

CVE-2020-12406

Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Thunderbird 68.9.0, Firefox 77, and Firefox ESR 68.9...

CVE-2020-12419

When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR 68.10, Firefox 78, and...

CVE-2020-12420

When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR 68.10, Firefox 78, and Thunderbird 68.10.0...

DEBIAN-CVE-2020-12418

Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR 68.10, Firefox 78, and Thunderbird 68.10.0...

CVE-2020-12418

Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR 68.10, Firefox 78, and Thunderbird 68.10.0...

CVE-2020-12399

NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird 68.9.0, Firefox 77, and Firefox ESR 68.9...

CVE-2020-12405

When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects Thunderbird 68.9.0, Firefox 77, and Firefox ESR 68.9...