Headline
CVE-2020-15652: Security Vulnerabilities fixed in Firefox ESR 68.11
By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.
Mozilla Foundation Security Advisory 2020-31
Announced
July 28, 2020
Impact
high
Products
Firefox ESR
Fixed in
- Firefox ESR 68.11
#CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
Reporter
Mikhail Oblozhikhin
Impact
high
Description
By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script.
References
- Bug 1634872
#CVE-2020-6514: WebRTC data channel leaks internal address to peer
Reporter
Natalie Silvanovich of Google Project Zero
Impact
high
Description
WebRTC used the memory address of a class instance as a connection identifier. Unfortunately, this value is often transmitted to the peer, which allows bypassing ASLR.
References
- Bug 1642792
#CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
Reporter
Reported by Pawel Wylecial of REDTEAM.PL
Impact
moderate
Description
Crafted media files could lead to a race in texture caches, resulting in a use-after-free, memory corruption, and a potentially exploitable crash.
References
- Bug 1635293
#CVE-2020-15650: Overwriting local files through malicious file picker application
Reporter
Pedro Oliveira
Impact
moderate
Description
Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile).
Note: This issue only affected Firefox for Android. Other operating systems are unaffected.
References
- Bug 1652360
#CVE-2020-15649: Exfiltrating local files through malicious file picker application
Reporter
Andrea Palazzo, Pedro Oliveira
Impact
moderate
Description
Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked.
Note: This issue only affected Firefox for Android. Other operating systems are unaffected.
References
- Bug 1475835, 1652364
#CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 68.11
Reporter
Mozilla developers
Impact
high
Description
Mozilla developers Jason Kratzer and Luke Wagner reported memory safety bugs present in Firefox 78 and Firefox ESR 68.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
References
- Memory safety bugs fixed in Firefox 79 and Firefox ESR 68.11
Related news
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, Safari 13.1.2. Visiting a malicious website may lead to address bar spoofing.
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.
The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.