Bug 712182 – <www-client/firefox{,-bin}-68.6.0: multiple vulnerabilities (MFSA-2020-09)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2020-03-11 20:12:26 UTC]

Incoming details.

[Comment 1 Thomas Deutschmann (RETIRED) 2020-03-11 20:13:46 UTC]

CVE-2020-6805: Use-after-free when removing data about origins

Impact
    high

Description

When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash.


CVE-2020-6806: BodyStream::OnInputStreamReady was missing protections against state confusion

Impact
    high

Description

By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash.


CVE-2020-6807: Use-after-free in cubeb during stream destruction

Impact
    high

Description

When a device was changed while a stream was about to be destroyed, the stream-reinit task may have been executed after the stream was destroyed, causing a use-after-free and a potentially exploitable crash.


CVE-2020-6811: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection

Impact
    moderate

Description

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution.


CVE-2019-20503: Out of bounds reads in sctp_load_addresses_from_init

Impact
    moderate

Description

The inputs to sctp_load_addresses_from_init are verified by sctp_arethere_unrecognized_parameters; however, the two functions handled parameter bounds differently, resulting in out of bounds reads when parameters are partially outside a chunk.


CVE-2020-6812: The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission

Impact
    moderate

Description

The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to simply 'AirPods'.


CVE-2020-6814: Memory safety bugs fixed in Firefox 74 and Firefox ESR 68.6

Impact
    high

Description

Mozilla developers and community members Byron Campen, Jason Kratzer, and Christian Holler reported memory safety bugs present in Firefox 73 and Firefox ESR 68.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

[Comment 2 Larry the Git Cow 2020-03-11 21:47:27 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=61cdee650c6f90d91018c70ec6cfeeba44b42861

commit 61cdee650c6f90d91018c70ec6cfeeba44b42861
Author:     Thomas Deutschmann <[e-mail]>
AuthorDate: 2020-03-11 20:38:10 +0000
Commit:     Thomas Deutschmann <[e-mail]>
CommitDate: 2020-03-11 21:47:09 +0000

    www-client/firefox: amd64 & x86 stable (bug #712182)
    
    Bug: https://bugs.gentoo.org/712182
    Package-Manager: Portage-2.3.93, Repoman-2.3.20
    Signed-off-by: Thomas Deutschmann <[e-mail]>

 www-client/firefox/firefox-68.6.0.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

[Comment 3 Mart Raudsepp 2020-03-12 12:56:18 UTC]

arm64 stable

[Comment 4 Larry the Git Cow 2020-03-12 14:16:06 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bfa9b84989f4acbd0bffa4ed98f5ff1dde2436e0

commit bfa9b84989f4acbd0bffa4ed98f5ff1dde2436e0
Author:     Thomas Deutschmann <[e-mail]>
AuthorDate: 2020-03-12 14:15:41 +0000
Commit:     Thomas Deutschmann <[e-mail]>
CommitDate: 2020-03-12 14:15:59 +0000

    www-client/firefox-bin: security cleanup (bug #712182)
    
    Bug: https://bugs.gentoo.org/712182
    Package-Manager: Portage-2.3.93, Repoman-2.3.20
    Signed-off-by: Thomas Deutschmann <[e-mail]>

 www-client/firefox-bin/Manifest                    | 186 -----------------
 .../firefox-bin/firefox-bin-68.5.0-r1.ebuild       | 197 ------------------
 www-client/firefox-bin/firefox-bin-73.0.1.ebuild   | 224 ---------------------
 3 files changed, 607 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=63b0ece8ee8ac95a566418254aa6896311778d31

commit 63b0ece8ee8ac95a566418254aa6896311778d31
Author:     Thomas Deutschmann <[e-mail]>
AuthorDate: 2020-03-12 14:14:47 +0000
Commit:     Thomas Deutschmann <[e-mail]>
CommitDate: 2020-03-12 14:15:58 +0000

    www-client/firefox: security cleanup (bug #712182)
    
    Bug: https://bugs.gentoo.org/712182
    Package-Manager: Portage-2.3.93, Repoman-2.3.20
    Signed-off-by: Thomas Deutschmann <[e-mail]>

 www-client/firefox/Manifest                        | 553 --------------
 .../firefox/files/firefox-68.2.0-rust-1.39+.patch  | 170 -----
 ...2358-fix-older-builds-with-newer-cbindgen.patch |  50 --
 www-client/firefox/firefox-68.2.0.ebuild           | 780 --------------------
 www-client/firefox/firefox-68.3.0.ebuild           | 775 --------------------
 www-client/firefox/firefox-68.4.1.ebuild           | 773 --------------------
 www-client/firefox/firefox-68.4.2.ebuild           | 773 --------------------
 www-client/firefox/firefox-68.5.0.ebuild           | 783 --------------------
 www-client/firefox/firefox-73.0.1.ebuild           | 810 ---------------------
 9 files changed, 5467 deletions(-)

[Comment 5 Thomas Deutschmann (RETIRED) 2020-03-12 18:48:28 UTC]

Added to an existing GLSA.

[Comment 6 GLSAMaker/CVETool Bot 2020-03-12 19:15:10 UTC]

This issue was resolved and addressed in
 GLSA 202003-02 at https://security.gentoo.org/glsa/202003-02
by GLSA coordinator Thomas Deutschmann (whissi).