Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2020-15652: Security Vulnerabilities fixed in Firefox ESR 68.11

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.

CVE
#vulnerability#web#android#google#java#firefox

Mozilla Foundation Security Advisory 2020-31

Announced

July 28, 2020

Impact

high

Products

Firefox ESR

Fixed in

  • Firefox ESR 68.11

#CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker

Reporter

Mikhail Oblozhikhin

Impact

high

Description

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script.

References

  • Bug 1634872

#CVE-2020-6514: WebRTC data channel leaks internal address to peer

Reporter

Natalie Silvanovich of Google Project Zero

Impact

high

Description

WebRTC used the memory address of a class instance as a connection identifier. Unfortunately, this value is often transmitted to the peer, which allows bypassing ASLR.

References

  • Bug 1642792

#CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture

Reporter

Reported by Pawel Wylecial of REDTEAM.PL

Impact

moderate

Description

Crafted media files could lead to a race in texture caches, resulting in a use-after-free, memory corruption, and a potentially exploitable crash.

References

  • Bug 1635293

#CVE-2020-15650: Overwriting local files through malicious file picker application

Reporter

Pedro Oliveira

Impact

moderate

Description

Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile).
Note: This issue only affected Firefox for Android. Other operating systems are unaffected.

References

  • Bug 1652360

#CVE-2020-15649: Exfiltrating local files through malicious file picker application

Reporter

Andrea Palazzo, Pedro Oliveira

Impact

moderate

Description

Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked.
Note: This issue only affected Firefox for Android. Other operating systems are unaffected.

References

  • Bug 1475835, 1652364

#CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 68.11

Reporter

Mozilla developers

Impact

high

Description

Mozilla developers Jason Kratzer and Luke Wagner reported memory safety bugs present in Firefox 78 and Firefox ESR 68.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

  • Memory safety bugs fixed in Firefox 79 and Firefox ESR 68.11

Related news

CVE-2020-9942: About the security content of Safari 13.1.2

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, Safari 13.1.2. Visiting a malicious website may lead to address bar spoofing.

CVE-2020-9918: About the security content of iOS 13.6 and iPadOS 13.6

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.

CVE-2020-15658: Security Vulnerabilities fixed in Firefox ESR 78.1

The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907