Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2021:0053)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:0053-1 advisory. - Mozilla: Use-after-free write when handling a malicious COOKIE-ECHO SCTP chunk CVE-2020-16044 Note that Nessus has not tested for this issue but has...

Oracle Linux 7 : firefox (ELSA-2021-0053)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-0053 advisory. 78.6.1-1.0.1 - Remove upstream references Orabug: 30143292 - Update distribution for Oracle Linux Orabug: 30143292 - Add firefox-oracle-default-prefs.js and...

Mozilla Firefox: Remote code execution

Background Mozilla Firefox is a popular open-source web browser from the Mozilla project. Description A use-after-free bug was discovered in Mozilla Firefox’s handling of SCTP. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of...

Updated firefox packages fix security vulnerability

A malicious peer could have modified a COOKIE-ECHO chunk in a SCTP packet in a way that potentially resulted in a use-after-free. We presume that with enough effort it could have been exploited to run arbitrary code. CVE-2020-16044...

Bugs in Firefox, Chrome, Edge Allow Remote System Hijacking

Makers of the Chrome, Firefox and Edge browsers are urging users to patch critical vulnerabilities that if exploited allow hackers to hijack systems running the software. The Mozilla Firefox vulnerability CVE-2020-16044 is separate from a bug reported in Google’s browser engine Chromium, which is...

USN-4687-1: Firefox vulnerability

A use-after-free was discovered in Firefox when handling SCTP packets. An attacker could potentially exploit this to cause a denial of service, or execute arbitrary code...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Firefox vulnerability (USN-4687-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4687-1 advisory. A use-after-free was discovered in Firefox when handling SCTP packets. An attacker could potentially exploit this to cause a denial of...

[ASA-202101-5] firefox: arbitrary code execution

Arch Linux Security Advisory ASA-202101-5 ========================================= Severity: Critical Date : 2021-01-08 CVE-ID : CVE-2020-16044 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1413 Summary ======= The package firefox before...

CVE-2020-16044

Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet...

Remote Code Execution (RCE)

firefox is vulnerable to remote code execution. The vulnerability exists due to a use-after-free error when processing COOKIE-ECHO chunk in a SCTP packet. An attacker can inject malicious data to the browser, triggering a use-after-free error and execute arbitrary code on the system...

CVE-2020-16044

Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet...

Mozilla Firefox ESR < 78.6.1

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 78.6.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2021-01 advisory. - A malicious peer could have modified a COOKIE-ECHO chunk in a SCTP packet in a way that potentially resulted in ...

Security fix for the ALT Linux 10 package firefox-esr version 78.6.1-alt1

Jan. 6, 2021 Andrey Cherepanov 78.6.1-alt1 - New version 78.6.1. - Security fixes: + CVE-2020-16044 Use-after-free write when handling a malicious COOKIE-ECHO SCTP chunk...

Mozilla Firefox < 84.0.2

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 84.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2021-01 advisory. - A malicious peer could have modified a COOKIE-ECHO chunk in a SCTP packet in a way that potentially resulted in a...

Mozilla Firefox < 84.0.2

The version of Firefox installed on the remote Windows host is prior to 84.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2021-01 advisory. - A malicious peer could have modified a COOKIE-ECHO chunk in a SCTP packet in a way that potentially resulted in a...

Arbitrary Code Execution

chromium is vulnerable to arbitrary code execution. A use after free in SCTP allows a remote attacker to exploit a heap corruption via a malicious HTML page...

NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2020-0074)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has thunderbird packages installed that are affected by multiple vulnerabilities: - Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after- free. We are aware of targeted attack...

OSV-2020-2193 Heap-buffer-overflow in sctp_process_init

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27900 Crash type: Heap-buffer-overflow READ 8 Crash state: sctpprocessinit sctpprocesscontrol sctpcommoninputprocessing...

Moderate: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 7.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Debian DLA-2385-1 : linux-4.19 security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, or information leak. CVE-2019-3874 Kernel buffers allocated by the SCTP network protocol were not limited by the memory cgroup controller. A local user could potentially us...