Linux Security
    Linux Security
    Linux Security

    Mageia 2020-0377: firefox security update

    Date
    121
    Posted By
    Mozilla developer Jason Kratzer reported memory safety bugs present in Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2020-15673).
    MGASA-2020-0377 - Updated firefox packages fix security vulnerabilities
    
    Publication date: 30 Sep 2020
    URL: https://advisories.mageia.org/MGASA-2020-0377.html
    Type: security
    Affected Mageia releases: 7
    CVE: CVE-2020-15673,
         CVE-2020-15676,
         CVE-2020-15677,
         CVE-2020-15678
    
    Mozilla developer Jason Kratzer reported memory safety bugs present in Firefox
    ESR 78.2. Some of these bugs showed evidence of memory corruption and we
    presume that with enough effort some of these could have been exploited to run
    arbitrary code (CVE-2020-15673).
    
    Firefox sometimes ran the onload handler for SVG elements that the DOM
    sanitizer decided to remove, resulting in a XSS issue due to JavaScript being
    executed after pasting attacker-controlled data into a contenteditable element
    (CVE-2020-15676).
    
    By exploiting an Open Redirect vulnerability on a website, an attacker could
    have spoofed the site displayed in the download file dialog to show the
    original site (the one suffering from the open redirect) rather than the site
    the file was actually downloaded from (CVE-2020-15677).
    
    When recursing through graphical layers while scrolling, an iterator may have
    become invalid, resulting in a potential use-after-free. This occurs because
    the function APZCTreeManager::ComputeClippedCompositionBounds did not follow
    iterator invalidation rules (CVE-2020-15678).
    
    The firefox package has been updated to the 78.x ESR branch, which brings
    significant changes in how CA certificates and smart cards are loaded into
    Firefox.
    
    The root CA certificates are no longer statically built into the nss library.
    They are loaded dynamically via p11-kit-trust, and therefore may be modified
    by the system administrator. Smart card support should be automatically loaded
    via p11-kit-trust as well, rather than requiring opensc to be manually loaded.
    NSS also now complies with the system crypto policy, which is provided by the
    crypto-policies package.  See the fedoraproject references for details.
    
    References:
    - https://bugs.mageia.org/show_bug.cgi?id=26711
    - https://fedoraproject.org/wiki/Changes/CryptoPolicy
    - https://fedoraproject.org/wiki/Changes/NSSLoadP11KitModules
    - https://groups.google.com/g/mozilla.dev.tech.nspr/c/zrirzzoOjeg
    - https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53_release_notes
    - https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53.1_release_notes
    - https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.54_release_notes
    - https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes
    - https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.56_release_notes
    - https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.57_release_notes
    - https://www.mozilla.org/en-US/security/advisories/mfsa2020-43/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15673
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15676
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15677
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15678
    
    SRPMS:
    - 7/core/crypto-policies-20200813-1.mga7
    - 7/core/p11-kit-0.23.21-1.mga7
    - 7/core/nspr-4.29-1.mga7
    - 7/core/rootcerts-20200911.00-1.mga7
    - 7/core/nss-3.57.0-1.mga7
    - 7/core/firefox-78.3.0-1.mga7
    - 7/core/firefox-l10n-78.3.0-1.mga7
    

    LinuxSecurity Poll

    Tails is the most secure Linux distro out there.

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 2 answer(s).
    /main-polls/41-ubuntu-is-a-more-secure-distro-than-fedora?task=poll.vote&format=json
    41
    radio
    [{"id":"142","title":"Yes - Tails get my vote!","votes":"4","type":"x","order":"1","pct":80,"resources":[]},{"id":"143","title":"Nope - Parrot OS has surpassed Tails in its security and privacy.","votes":"1","type":"x","order":"2","pct":20,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350

    Please vote first in order to view vote results.


    VIEW MORE POLLS

    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.