Ubuntu 20.04 LTS USN-4408-1 Critical: Firefox DoS and Code Execution

ubuntu

July 2, 2020

Firefox could be made to crash or run programs as your login if it opened a malicious website.

Summary

Firefox could be made to crash or run programs as your login if it

opened a malicious website.

Software Description:

- firefox: Mozilla Open Source web browser

Details:

Multiple security issues were discovered in Firefox. If a user were

tricked in to opening a specially crafted website, an attacker could

potentially exploit these to cause a denial of service, obtain sensitive

information, bypass permission prompts, or execute arbitrary code.

(CVE-2020-12415, CVE-2020-12416, CVE-2020-12417, CVE-2020-12418,

CVE-2020-12419, CVE-2020-12420, CVE-2020-12422, CVE-2020-12424,

CVE-2020-12425, CVE-2020-12426)

It was discovered that when performing add-on updates, certificate chains

not terminating with built-in roots were silently rejected. This could

result in add-ons becoming outdated. (CVE-2020-12421)

Topics Covered

security advisory denial of service firefox ubuntu malicious website

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
  firefox                         78.0.1+build1-0ubuntu0.20.04.1

Ubuntu 19.10:
  firefox                         78.0.1+build1-0ubuntu0.19.10.1

Ubuntu 18.04 LTS:
  firefox                         78.0.1+build1-0ubuntu0.18.04.1

Ubuntu 16.04 LTS:
  firefox                         78.0.1+build1-0ubuntu0.16.04.1

After a standard system update you need to restart Firefox to make
all the necessary changes.