openSUSE: 2020:2318-1 critical: MozillaFirefox

Date 22 Dec 2020

Category openSUSE Linux Distribution - Security Advisories

270

Posted By LinuxSecurity Advisories

An update that fixes 8 vulnerabilities is now available.


   openSUSE Security Update: Security update for MozillaFirefox
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2020:2318-1
Rating:             critical
References:         #1180039 
Cross-References:   CVE-2020-16042 CVE-2020-26971 CVE-2020-26973
                    CVE-2020-26974 CVE-2020-26978 CVE-2020-35111
                    CVE-2020-35112 CVE-2020-35113
Affected Products:
                    openSUSE Leap 15.2
______________________________________________________________________________

   An update that fixes 8 vulnerabilities is now available.

Description:

   This update for MozillaFirefox fixes the following issues:

   - Firefox Extended Support Release 78.6.0 ESR
     * Fixed: Various stability, functionality, and security fixes MFSA
       2020-55 (bsc#1180039)
     * CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused
       uninitialized memory to be exposed
     * CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
     * CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect
       sanitization
     * CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis
       resulted in a heap use-after-free
     * CVE-2020-26978 (bmo#1677047) Internal network hosts could have been
       probed by a malicious webpage
     * CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch
       view-source URLs
     * CVE-2020-35112 (bmo#1661365) Opening an extension-less download may
       have inadvertently launched an executable instead
     * CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in
       Firefox 84 and Firefox ESR 78.6

   This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.2:

      zypper in -t patch openSUSE-2020-2318=1



Package List:

   - openSUSE Leap 15.2 (x86_64):

      MozillaFirefox-78.6.0-lp152.2.34.1
      MozillaFirefox-branding-upstream-78.6.0-lp152.2.34.1
      MozillaFirefox-buildsymbols-78.6.0-lp152.2.34.1
      MozillaFirefox-debuginfo-78.6.0-lp152.2.34.1
      MozillaFirefox-debugsource-78.6.0-lp152.2.34.1
      MozillaFirefox-devel-78.6.0-lp152.2.34.1
      MozillaFirefox-translations-common-78.6.0-lp152.2.34.1
      MozillaFirefox-translations-other-78.6.0-lp152.2.34.1


References:

   https://www.suse.com/security/cve/CVE-2020-16042.html
   https://www.suse.com/security/cve/CVE-2020-26971.html
   https://www.suse.com/security/cve/CVE-2020-26973.html
   https://www.suse.com/security/cve/CVE-2020-26974.html
   https://www.suse.com/security/cve/CVE-2020-26978.html
   https://www.suse.com/security/cve/CVE-2020-35111.html
   https://www.suse.com/security/cve/CVE-2020-35112.html
   https://www.suse.com/security/cve/CVE-2020-35113.html
   https://bugzilla.suse.com/1180039
_______________________________________________
openSUSE Security Announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it.
To unsubscribe, email This email address is being protected from spambots. You need JavaScript enabled to view it.
List Netiquette: https://en.opensuse.org/openSUSE:Mailing_list_netiquette
List Archives: https://lists.opensuse.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it.