Red Hat Security Advisory: firefox security and bug fix update

Fixed packages 6

Vulnerabilities 12

• Unscored —
  CVE-2020-12422

  In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, …

  Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu Alpine
  Jul 9, 2020
• Unscored —
  CVE-2020-12424

  When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, …

  Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu Alpine
  Jul 9, 2020
• Unscored —
  CVE-2020-12425

  Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, lead…

  Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu Alpine
  Jul 9, 2020
• Unscored —
  CVE-2020-15648

  Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-…

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu
  Aug 10, 2020
• Unscored —
  CVE-2020-15653

  An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led t…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Aug 10, 2020
• Unscored —
  CVE-2020-15654

  When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Aug 10, 2020
• Unscored —
  CVE-2020-15656

  JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mi…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Aug 10, 2020
• Unscored —
  CVE-2020-15658

  The code for downloading files did not properly take care of special characters, which led to an attacker being able to…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine
  Aug 10, 2020
• Unscored —
  CVE-2020-15673

  Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed ev…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Oct 1, 2020
• Unscored —
  CVE-2020-15676

  Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaSc…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Oct 1, 2020
• Unscored —
  CVE-2020-15677

  By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the dow…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Oct 1, 2020
• Unscored —
  CVE-2020-15678

  When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Oct 1, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1861645
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1861646
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1861647
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1861649
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1868842
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1872537
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1872538
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1872539
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1872540
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1881664
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1881665
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1881666
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1881667
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4080.json
• report
  https://access.redhat.com/security/cve/CVE-2020-12422
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12422
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12422
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-24/#CVE-2020-12422
• report
  https://access.redhat.com/security/cve/CVE-2020-12424
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12424
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12424
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-24/#CVE-2020-12424
• report
  https://access.redhat.com/security/cve/CVE-2020-12425
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12425
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12425
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-24/#CVE-2020-12425
• report
  https://access.redhat.com/security/cve/CVE-2020-15648
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-15648
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-15648
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-28/#CVE-2020-15648
• report
  https://access.redhat.com/security/cve/CVE-2020-15653
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-15653
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-15653
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-33/#CVE-2020-15653
• report
  https://access.redhat.com/security/cve/CVE-2020-15654
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-15654
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-15654
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-33/#CVE-2020-15654