Summary: | <www-client/firefox{,-bin}-68.6.0: multiple vulnerabilities (MFSA-2020-09) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | GLSAMaker/CVETool Bot <glsamaker> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | major | CC: | mozilla |
Priority: | Normal | Flags: | stable-bot:
sanity-check+
|
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | https://www.mozilla.org/en-US/security/advisories/mfsa2020-09/ | ||
See Also: | https://bugs.gentoo.org/show_bug.cgi?id=717158 | ||
Whiteboard: | A2 [glsa+ cve] | ||
Package list: |
www-client/firefox-68.6.0-r1
|
Runtime testing required: | --- |
Bug Depends on: | |||
Bug Blocks: | 709346 |
Description
GLSAMaker/CVETool Bot
2020-03-11 20:12:26 UTC
CVE-2020-6805: Use-after-free when removing data about origins Impact high Description When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash. CVE-2020-6806: BodyStream::OnInputStreamReady was missing protections against state confusion Impact high Description By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash. CVE-2020-6807: Use-after-free in cubeb during stream destruction Impact high Description When a device was changed while a stream was about to be destroyed, the stream-reinit task may have been executed after the stream was destroyed, causing a use-after-free and a potentially exploitable crash. CVE-2020-6811: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection Impact moderate Description The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. CVE-2019-20503: Out of bounds reads in sctp_load_addresses_from_init Impact moderate Description The inputs to sctp_load_addresses_from_init are verified by sctp_arethere_unrecognized_parameters; however, the two functions handled parameter bounds differently, resulting in out of bounds reads when parameters are partially outside a chunk. CVE-2020-6812: The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission Impact moderate Description The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to simply 'AirPods'. CVE-2020-6814: Memory safety bugs fixed in Firefox 74 and Firefox ESR 68.6 Impact high Description Mozilla developers and community members Byron Campen, Jason Kratzer, and Christian Holler reported memory safety bugs present in Firefox 73 and Firefox ESR 68.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=61cdee650c6f90d91018c70ec6cfeeba44b42861 commit 61cdee650c6f90d91018c70ec6cfeeba44b42861 Author: Thomas Deutschmann <whissi@gentoo.org> AuthorDate: 2020-03-11 20:38:10 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2020-03-11 21:47:09 +0000 www-client/firefox: amd64 & x86 stable (bug #712182) Bug: https://bugs.gentoo.org/712182 Package-Manager: Portage-2.3.93, Repoman-2.3.20 Signed-off-by: Thomas Deutschmann <whissi@gentoo.org> www-client/firefox/firefox-68.6.0.ebuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) arm64 stable The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bfa9b84989f4acbd0bffa4ed98f5ff1dde2436e0 commit bfa9b84989f4acbd0bffa4ed98f5ff1dde2436e0 Author: Thomas Deutschmann <whissi@gentoo.org> AuthorDate: 2020-03-12 14:15:41 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2020-03-12 14:15:59 +0000 www-client/firefox-bin: security cleanup (bug #712182) Bug: https://bugs.gentoo.org/712182 Package-Manager: Portage-2.3.93, Repoman-2.3.20 Signed-off-by: Thomas Deutschmann <whissi@gentoo.org> www-client/firefox-bin/Manifest | 186 ----------------- .../firefox-bin/firefox-bin-68.5.0-r1.ebuild | 197 ------------------ www-client/firefox-bin/firefox-bin-73.0.1.ebuild | 224 --------------------- 3 files changed, 607 deletions(-) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=63b0ece8ee8ac95a566418254aa6896311778d31 commit 63b0ece8ee8ac95a566418254aa6896311778d31 Author: Thomas Deutschmann <whissi@gentoo.org> AuthorDate: 2020-03-12 14:14:47 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2020-03-12 14:15:58 +0000 www-client/firefox: security cleanup (bug #712182) Bug: https://bugs.gentoo.org/712182 Package-Manager: Portage-2.3.93, Repoman-2.3.20 Signed-off-by: Thomas Deutschmann <whissi@gentoo.org> www-client/firefox/Manifest | 553 -------------- .../firefox/files/firefox-68.2.0-rust-1.39+.patch | 170 ----- ...2358-fix-older-builds-with-newer-cbindgen.patch | 50 -- www-client/firefox/firefox-68.2.0.ebuild | 780 -------------------- www-client/firefox/firefox-68.3.0.ebuild | 775 -------------------- www-client/firefox/firefox-68.4.1.ebuild | 773 -------------------- www-client/firefox/firefox-68.4.2.ebuild | 773 -------------------- www-client/firefox/firefox-68.5.0.ebuild | 783 -------------------- www-client/firefox/firefox-73.0.1.ebuild | 810 --------------------- 9 files changed, 5467 deletions(-) Added to an existing GLSA. This issue was resolved and addressed in GLSA 202003-02 at https://security.gentoo.org/glsa/202003-02 by GLSA coordinator Thomas Deutschmann (whissi). |