Incoming details.
CVE-2020-6805: Use-after-free when removing data about origins Impact high Description When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash. CVE-2020-6806: BodyStream::OnInputStreamReady was missing protections against state confusion Impact high Description By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash. CVE-2020-6807: Use-after-free in cubeb during stream destruction Impact high Description When a device was changed while a stream was about to be destroyed, the stream-reinit task may have been executed after the stream was destroyed, causing a use-after-free and a potentially exploitable crash. CVE-2020-6811: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection Impact moderate Description The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. CVE-2019-20503: Out of bounds reads in sctp_load_addresses_from_init Impact moderate Description The inputs to sctp_load_addresses_from_init are verified by sctp_arethere_unrecognized_parameters; however, the two functions handled parameter bounds differently, resulting in out of bounds reads when parameters are partially outside a chunk. CVE-2020-6812: The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission Impact moderate Description The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to simply 'AirPods'. CVE-2020-6814: Memory safety bugs fixed in Thunderbird 68.6 Impact high Description Mozilla developers Byron Campen, Jason Kratzer, and Christian Holler reported memory safety bugs present in Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=727675d5508c3f585969194507cdf7d6f10aff1a commit 727675d5508c3f585969194507cdf7d6f10aff1a Author: Thomas Deutschmann <whissi@gentoo.org> AuthorDate: 2020-03-14 15:59:57 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2020-03-14 15:59:57 +0000 mail-client/thunderbird-bin: security cleanup Bug: https://bugs.gentoo.org/712518 Package-Manager: Portage-2.3.93, Repoman-2.3.20 Signed-off-by: Thomas Deutschmann <whissi@gentoo.org> mail-client/thunderbird-bin/Manifest | 55 ------- .../thunderbird-bin/thunderbird-bin-68.5.0.ebuild | 182 --------------------- 2 files changed, 237 deletions(-) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=332f54dbc7afe50397197a21e67a75ca39f5fda4 commit 332f54dbc7afe50397197a21e67a75ca39f5fda4 Author: Thomas Deutschmann <whissi@gentoo.org> AuthorDate: 2020-03-14 15:59:18 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2020-03-14 15:59:18 +0000 mail-client/thunderbird: security cleanup Bug: https://bugs.gentoo.org/712518 Package-Manager: Portage-2.3.93, Repoman-2.3.20 Signed-off-by: Thomas Deutschmann <whissi@gentoo.org> mail-client/thunderbird/Manifest | 54 -- mail-client/thunderbird/thunderbird-68.5.0.ebuild | 777 ---------------------- 2 files changed, 831 deletions(-) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d8307cd87b58fb07c9ac6908aabc770c464c0f06 commit d8307cd87b58fb07c9ac6908aabc770c464c0f06 Author: Thomas Deutschmann <whissi@gentoo.org> AuthorDate: 2020-03-14 15:58:18 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2020-03-14 15:58:18 +0000 mail-client/thunderbird: amd64 & x86 stable (bug #712518) Bug: https://bugs.gentoo.org/712518 Package-Manager: Portage-2.3.93, Repoman-2.3.20 Signed-off-by: Thomas Deutschmann <whissi@gentoo.org> mail-client/thunderbird/thunderbird-68.6.0.ebuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
This issue was resolved and addressed in GLSA 202003-10 at https://security.gentoo.org/glsa/202003-10 by GLSA coordinator Thomas Deutschmann (whissi).
