Summary
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, spoof the URL or
other browser chrome, obtain sensitive information, bypass Content
Security Policy (CSP) protections, or execute arbitrary code.
(CVE-2019-20503, CVE-2020-6805, CVE-2020-6806, CVE-2020-6807,
CVE-2020-6808, CVE-2020-6810, CVE-2020-6812, CVE-2020-6813, CVE-2020-6814,
CVE-2020-6815)
It was discovered that Web Extensions with the all-url permission could
access local files. If a user were tricked in to installing a specially
crafted extension, an attacker could potentially exploit this to obtain
sensitive information. (CVE-2020-6809)
It was discovered that the Devtools' 'Copy as cURL' feature did not fully
escape website-controlled data. If a user were tricked in to using the
'Copy as cURL' feature to copy and paste a command with specially crafted
data in to a terminal, an attacker could potentially exploit this to
execute arbitrary commands via command injection. (CVE-2020-6811)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | firefox | 74.0+build3-0ubuntu0.16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 74.0+build3-0ubuntu0.18.04.1 |
Vulnerabilities 12
-
Unscored —
usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.
-
Unscored —
When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, re…
-
Unscored —
By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resiz…
-
Unscored —
When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task may have been e…
-
Unscored —
When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML do…
-
Unscored —
When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was poss…
-
Unscored —
After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification t…
-
Unscored —
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be …
-
Unscored —
The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's …
-
Unscored —
When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block co…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evide…
-
Unscored —
Mozilla developers reported memory safety and script safety bugs present in Firefox 73. Some of these bugs showed evide…
References
-
report
https://ubuntu.com/security/CVE-2019-20503
-
report
https://ubuntu.com/security/CVE-2020-6805
-
report
https://ubuntu.com/security/CVE-2020-6806
-
report
https://ubuntu.com/security/CVE-2020-6807
-
report
https://ubuntu.com/security/CVE-2020-6808
-
report
https://ubuntu.com/security/CVE-2020-6809
-
report
https://ubuntu.com/security/CVE-2020-6810
-
report
https://ubuntu.com/security/CVE-2020-6811
-
report
https://ubuntu.com/security/CVE-2020-6812
-
report
https://ubuntu.com/security/CVE-2020-6813
-
report
https://ubuntu.com/security/CVE-2020-6814
-
report
https://ubuntu.com/security/CVE-2020-6815