ArchLinux: 202005-3: firefox: multiple issues
Summary
- CVE-2020-6831 (arbitrary code execution)
A buffer overflow could occur when parsing and validating SCTP chunks
in WebRTC, in Firefox before 76.0 and chromium before 81.0.4044.138.
This could have led to memory corruption and a potentially exploitable
crash.
- CVE-2020-12387 (arbitrary code execution)
A race condition has been found in Firefox before 76.0, when running
shutdown code for Web Worker, leading to a use-after-free
vulnerability. This results in a potentially exploitable crash.
- CVE-2020-12390 (insufficient validation)
An incorrect origin serialization of URLs with IPv6 addresses issue has
been found in Firefox before 76.0, and could lead to incorrect security
checks.
- CVE-2020-12391 (arbitrary code execution)
Documents formed using data: URLs in an object element failed to
inherit the CSP of the creating context in Firefox before 76.0. This
allowed the execution of scripts that should have been blocked, albeit
with a unique opaque origin.
- CVE-2020-12392 (content spoofing)
The 'Copy as cURL' feature of Devtools' network tab did not properly
escape the HTTP POST data of a request in Firefox before 76.0, which
can be controlled by the website. If a user used the 'Copy as cURL'
feature and pasted the command into a terminal, it could have resulted
in the disclosure of local files.
- CVE-2020-12394 (content spoofing)
A logic flaw has been found in the location bar implementation of
Firefox before 76.0, and could have allowed a local attacker to spoof
the current location by selecting a different origin and removing focus
from the input element.
- CVE-2020-12395 (arbitrary code execution)
Several memory safety bugs has been found in Firefox before 76.0 and
Firefox ESR before 68.8. Some of these bugs showed evidence of memory
corruption and Mozilla presumes that with enough effort some of these
could have been exploited to run arbitrary code.
- CVE-2020-12396 (arbitrary code execution)
Several memory safety bugs have been found in Firefox before 76.0. Some
of these bugs showed evidence of memory corruption and Mozilla presumes
that with enough effort some of these could have been exploited to run
arbitrary code.
Resolution
Upgrade to 76.0-1.
# pacman -Syu "firefox>=76.0-1"
The problems have been fixed upstream in version 76.0.
References
https://bugzilla.mozilla.org/show_bug.cgi?id=1632241 https://bugs.chromium.org/p/chromium/issues/detail https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-6831 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12387 https://bugzilla.mozilla.org/show_bug.cgi?id=1545345 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12390 https://bugzilla.mozilla.org/show_bug.cgi?id=1141959 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12391 https://bugzilla.mozilla.org/show_bug.cgi?id=1457100 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12392 https://bugzilla.mozilla.org/show_bug.cgi?id=1614468 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12394 https://bugzilla.mozilla.org/show_bug.cgi?id=1628288 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12395 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1595886%2C1611482%2C1614704%2C1624098%2C1625749%2C1626382%2C1628076%2C1631508 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12396 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1339601%2C1611938%2C1620488%2C1622291%2C1627644 https://security.archlinux.org/CVE-2020-6831 https://security.archlinux.org/CVE-2020-12387 https://security.archlinux.org/CVE-2020-12390 https://security.archlinux.org/CVE-2020-12391 https://security.archlinux.org/CVE-2020-12392 https://security.archlinux.org/CVE-2020-12394 https://security.archlinux.org/CVE-2020-12395 https://security.archlinux.org/CVE-2020-12396
Workaround
None.
