Mageia 2020-0348 Moderate: Firefox Extension Installation Risks
mageia
August 27, 2020
By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt...
Summary
By holding a reference to the eval() function from an about:blank window, a
malicious webpage could have gained access to the InstallTrigger object which
would allow them to prompt the user to install an extension. Combined with user
confusion, this could result in an unintended or malicious extension being
installed (CVE-2020-15664).
When aborting an operation, such as a fetch, an abort signal may be deleted
while alerting the objects to be notified. This results in a use-after-free and
we presume that with enough effort it could have been exploited to run
arbitrary code (CVE-2020-15669).
References
- https://bugs.mageia.org/show_bug.cgi?id=27193
- https://groups.google.com/g/mozilla.dev.tech.nspr/c/YLamaq1rVco
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-37/
- https://www.cve.org/CVERecord?id=CVE-2020-15664
- https://www.cve.org/CVERecord?id=CVE-2020-15669
Topics Covered
Resolution
SRPMS
- 7/core/nspr-4.28-1.mga7
- 7/core/firefox-68.12.0-2.mga7
- 7/core/firefox-l10n-68.12.0-1.mga7
PREVIOUS
NEXT
Severity
important
Lowest
Low
Medium
High
Critical
Publication date: 27 Aug 2020
URL: https://advisories.mageia.org/MGASA-2020-0348.html
Type: security
CVE: CVE-2020-15664,
CVE-2020-15669
Topics Covered
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!