Red Hat Security Advisory: firefox security update

Fixed packages 3

Vulnerabilities 10

• Unscored —
  CVE-2020-12422

  In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, …

  Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu Alpine
  Jul 9, 2020
• Unscored —
  CVE-2020-12424

  When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, …

  Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu Alpine
  Jul 9, 2020
• Unscored —
  CVE-2020-12425

  Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, lead…

  Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu Alpine
  Jul 9, 2020
• Unscored —
  CVE-2020-15648

  Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-…

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu
  Aug 10, 2020
• Unscored —
  CVE-2020-15653

  An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led t…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Aug 10, 2020
• Unscored —
  CVE-2020-15654

  When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Aug 10, 2020
• Unscored —
  CVE-2020-15656

  JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mi…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Aug 10, 2020
• Unscored —
  CVE-2020-15658

  The code for downloading files did not properly take care of special characters, which led to an attacker being able to…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Aug 10, 2020
• Unscored —
  CVE-2020-15664

  By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access …

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Oct 1, 2020
• Unscored —
  CVE-2020-15669

  When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. …

  Mozilla Thunderbird Firefox ESR thunderbird Browsers Debian Ubuntu
  Oct 1, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1861645
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1861646
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1861647
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1861649
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1872531
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1872532
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1872537
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1872538
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1872539
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1872540
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3555.json
• report
  https://access.redhat.com/security/cve/CVE-2020-12422
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12422
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12422
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-24/#CVE-2020-12422
• report
  https://access.redhat.com/security/cve/CVE-2020-12424
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12424
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12424
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-24/#CVE-2020-12424
• report
  https://access.redhat.com/security/cve/CVE-2020-12425
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12425
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12425
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-24/#CVE-2020-12425
• report
  https://access.redhat.com/security/cve/CVE-2020-15648
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-15648
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-15648
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-28/#CVE-2020-15648
• report
  https://access.redhat.com/security/cve/CVE-2020-15653
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-15653
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-15653
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-33/#CVE-2020-15653
• report
  https://access.redhat.com/security/cve/CVE-2020-15654
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-15654
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-15654
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-33/#CVE-2020-15654
• report
  https://access.redhat.com/security/cve/CVE-2020-15656
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-15656
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-15656