Summary
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information, or execute arbitrary code. (CVE-2020-6821, CVE-2020-6822,
CVE-2020-6824, CVE-2020-6825, CVE-2020-6826)
It was discovered that extensions could obtain auth codes from OAuth login
flows in some circumstances. If a user were tricked in to installing a
specially crafted extension, an attacker could potentially exploit this to
obtain access to the user's account. (CVE-2020-6823)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | firefox | 75.0+build3-0ubuntu0.16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 75.0+build3-0ubuntu0.18.04.1 |
Vulnerabilities 6
-
Unscored —
When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method…
-
Unscored —
On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDeco…
-
Unscored —
A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, …
-
Unscored —
Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing…
-
Unscored —
Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefo…
-
Unscored —
Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74. Some…