Linux Security
    Linux Security
    Linux Security

    ArchLinux: 202006-1: firefox: multiple issues

    Date
    265
    Posted By
    The package firefox before version 77.0-1 is vulnerable to multiple issues including arbitrary code execution, denial of service, private key recovery and content spoofing.
    Arch Linux Security Advisory ASA-202006-1
    =========================================
    
    Severity: High
    Date    : 2020-06-02
    CVE-ID  : CVE-2020-12399 CVE-2020-12405 CVE-2020-12406 CVE-2020-12407
              CVE-2020-12408 CVE-2020-12409 CVE-2020-12410 CVE-2020-12411
    Package : firefox
    Type    : multiple issues
    Remote  : Yes
    Link    : https://security.archlinux.org/AVG-1173
    
    Summary
    =======
    
    The package firefox before version 77.0-1 is vulnerable to multiple
    issues including arbitrary code execution, denial of service, private
    key recovery and content spoofing.
    
    Resolution
    ==========
    
    Upgrade to 77.0-1.
    
    # pacman -Syu "firefox>=77.0-1"
    
    The problems have been fixed upstream in version 77.0.
    
    Workaround
    ==========
    
    None.
    
    Description
    ===========
    
    - CVE-2020-12399 (private key recovery)
    
    NSS before 3.52.1, as used in Firefox before 77.0 and Thunderbird
    before 68.9.0, has shown timing differences when performing DSA
    signatures, which was exploitable and could eventually leak private
    keys.
    
    - CVE-2020-12405 (denial of service)
    
    When browsing a malicious page in Firefox before 77.0 and Thunderbird
    before 68.9.0, a race condition in our SharedWorkerService could occur
    and lead to a potentially exploitable crash.
    
    - CVE-2020-12406 (arbitrary code execution)
    
    Mozilla Developer Iain Ireland discovered a missing type check in
    Firefox before 77.0 and Thunderbird before 68.9.0 during unboxed
    objects removal, resulting in a crash. We presume that with enough
    effort that it could be exploited to run arbitrary code.
    
    - CVE-2020-12407 (denial of service)
    
    Mozilla Developer Nicolas Silva found that when using WebRender,
    Firefox would under certain conditions leak arbitrary GPU memory to the
    visible screen. The leaked memory content was visible to the user, but
    not observable from web content.
    
    - CVE-2020-12408 (content spoofing)
    
    When browsing a document hosted on an IP address, an attacker could
    insert certain characters to flip domain and path information in the
    address bar.
    
    - CVE-2020-12409 (content spoofing)
    
    When using certain blank characters in a URL, they where incorrectly
    rendered as spaces instead of an encoded URL.
    
    - CVE-2020-12410 (arbitrary code execution)
    
    Mozilla developers Tom Tung and Karl Tomlinson reported memory safety
    bugs present in Firefox 76, Firefox ESR 68.8 and Thunderbird before
    68.9.0. Some of these bugs showed evidence of memory corruption and
    Mozilla presumes that with enough effort some of these could have been
    exploited to run arbitrary code.
    
    - CVE-2020-12411 (arbitrary code execution)
    
    Mozilla developers :Gijs (he/him), Randell Jesup reported memory safety
    bugs present in Firefox 76. Some of these bugs showed evidence of
    memory corruption and we presume that with enough effort some of these
    could have been exploited to run arbitrary code.
    
    Impact
    ======
    
    A remote attacker might be able to recover private keys, spoof content,
    execute arbitrary code or crash the application.
    
    References
    ==========
    
    https://www.mozilla.org/en-US/security/advisories/mfsa2020-20/
    https://bugzilla.mozilla.org/show_bug.cgi?id=1631576
    https://hg.mozilla.org/projects/nss/rev/daa823a4a29bcef0fec33a379ec83857429aea2e
    https://bugzilla.mozilla.org/show_bug.cgi?id=1631618
    https://bugzilla.mozilla.org/show_bug.cgi?id=1639590
    https://bugzilla.mozilla.org/show_bug.cgi?id=1637112
    https://bugzilla.mozilla.org/show_bug.cgi?id=1623888
    https://bugzilla.mozilla.org/show_bug.cgi?id=1629506
    https://bugzilla.mozilla.org/buglist.cgi?bug_id=1619305%2C1632717
    https://bugzilla.mozilla.org/show_bug.cgi?id=1506173
    https://security.archlinux.org/CVE-2020-12399
    https://security.archlinux.org/CVE-2020-12405
    https://security.archlinux.org/CVE-2020-12406
    https://security.archlinux.org/CVE-2020-12407
    https://security.archlinux.org/CVE-2020-12408
    https://security.archlinux.org/CVE-2020-12409
    https://security.archlinux.org/CVE-2020-12410
    https://security.archlinux.org/CVE-2020-12411
    

    LinuxSecurity Poll

    I agree with Linus Torvalds - Apple's new M1-powered laptops should run on Linux.

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 2 answer(s).
    /main-polls/45-i-agree-with-linus-torvalds-apple-s-new-m1-powered-laptops-should-run-on-linux?task=poll.vote&format=json
    45
    radio
    [{"id":"158","title":"True","votes":"8","type":"x","order":"1","pct":100,"resources":[]},{"id":"159","title":"False","votes":"0","type":"x","order":"2","pct":0,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350

    Please vote first in order to view vote results.


    VIEW MORE POLLS

    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.