Mageia 2020-0318: firefox security update | LinuxSecurity.com

Advisories

MGASA-2020-0318 - Updated firefox packages fix security vulnerability

Publication date: 18 Aug 2020
URL: https://advisories.mageia.org/MGASA-2020-0318.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2020-6463,
     CVE-2020-6514,
     CVE-2020-6829,
     CVE-2020-12400,
     CVE-2020-12401,
     CVE-2020-12403,
     CVE-2020-15652,
     CVE-2020-15659

WebRTC used the memory address of a class instance as a connection identifier.
Unfortunately, this value is often transmitted to the peer, which
allows bypassing ASLR (CVE-2020-6514).

Crafted media files could lead to a race in texture caches, resulting in a
use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture, memory
corruption, and a potentially exploitable crash (CVE-2020-6463).

By observing the stack trace for JavaScript errors in web workers, it was
possible to leak the result of a cross-origin redirect. This applied only to
content that can be parsed as script (CVE-2020-15652).

Mozilla developers Jason Kratzer and Luke Wagner reported memory safety bugs
present in Firefox 78 and Firefox ESR 68.10. Some of these bugs showed evidence
of memory corruption and we presume that with enough effort some of these could
have been exploited to run arbitrary code (CVE-2020-15659).

Using the EM side-channel, it is possible to extract the position of zero and
non-zero wNAF digits while nss-certutil tool performs scalar multiplication
during the ECDSA signature generation, leaking partial information about the
ECDSA nonce. Given a small number of ECDSA signatures, this information can be
used to steal the private key. The highest threat from this vulnerability is to
data confidentiality (CVE-2020-6829).

A side channel flaw was found in the way P-384 and P-521 curses are used in
generation EDSA signatures, leaking partial information about the ECDSA nonce.
Given a small number of ECDSA signatures, this information can be used to steal
the private key. The highest threat from this vulnerability is to data
confidentiality (CVE-2020-12400).

Using the EM side-channel, it is possible to extract the position of zero and
non-zero wNAF digits while nss-certutil tool performs scalar multiplication
during the ECDSA signature generation, leaking partial information about the
ECDSA nonce. Given a small number of ECDSA signatures, this information can be
used to steal the private key. The highest threat from this vulnerability is to
data confidentiality (CVE-2020-12401).

Multi-part ChaCha20 was not functioning correctly and tag length was not
strictly enforced (CVE-2020-12403).

References:
- https://bugs.mageia.org/show_bug.cgi?id=27011
- https://groups.google.com/forum/#!topic/mozilla.dev.tech.nspr/3626XG8mLJw
- https://bugzilla.redhat.com/show_bug.cgi?id=1826187
- https://bugzilla.redhat.com/show_bug.cgi?id=1853983
- https://bugzilla.redhat.com/show_bug.cgi?id=1851294
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-31/
- https://ubuntu.com/security/notices/USN-4455-1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6463
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6514
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6829
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12400
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12401
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12403
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15652
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15659

SRPMS:
- 7/core/firefox-68.11.0-1.mga7
- 7/core/firefox-l10n-68.11.0-1.mga7
- 7/core/nspr-4.27-1.mga7
- 7/core/nss-3.52.1-1.2.mga7

Mageia 2020-0318: firefox security update

WebRTC used the memory address of a class instance as a connection identifier

Summary

WebRTC used the memory address of a class instance as a connection identifier. Unfortunately, this value is often transmitted to the peer, which allows bypassing ASLR (CVE-2020-6514).
Crafted media files could lead to a race in texture caches, resulting in a use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture, memory corruption, and a potentially exploitable crash (CVE-2020-6463).
By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script (CVE-2020-15652).
Mozilla developers Jason Kratzer and Luke Wagner reported memory safety bugs present in Firefox 78 and Firefox ESR 68.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2020-15659).
Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality (CVE-2020-6829).
A side channel flaw was found in the way P-384 and P-521 curses are used in generation EDSA signatures, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality (CVE-2020-12400).
Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality (CVE-2020-12401).
Multi-part ChaCha20 was not functioning correctly and tag length was not strictly enforced (CVE-2020-12403).

References

- https://bugs.mageia.org/show_bug.cgi?id=27011

- https://groups.google.com/forum/#!topic/mozilla.dev.tech.nspr/3626XG8mLJw

- https://bugzilla.redhat.com/show_bug.cgi?id=1826187

- https://bugzilla.redhat.com/show_bug.cgi?id=1853983

- https://bugzilla.redhat.com/show_bug.cgi?id=1851294

- https://www.mozilla.org/en-US/security/advisories/mfsa2020-31/

- https://ubuntu.com/security/notices/USN-4455-1

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6463

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6514

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6829

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12400

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12401

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12403

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15652

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15659

Resolution

MGASA-2020-0318 - Updated firefox packages fix security vulnerability

SRPMS

- 7/core/firefox-68.11.0-1.mga7

- 7/core/firefox-l10n-68.11.0-1.mga7

- 7/core/nspr-4.27-1.mga7

- 7/core/nss-3.52.1-1.2.mga7

Severity
Publication date: 18 Aug 2020
URL: https://advisories.mageia.org/MGASA-2020-0318.html
Type: security
CVE: CVE-2020-6463, CVE-2020-6514, CVE-2020-6829, CVE-2020-12400, CVE-2020-12401, CVE-2020-12403, CVE-2020-15652, CVE-2020-15659

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.